Star-shaped anti-patch attack method and device for graph convolutional network

Abstract

The invention provides a star-shaped anti-patch attack method for a graph convolutional network, and the method comprises the steps: constructing a star-shaped structure patch based on a false node with a null feature, injecting the star-shaped structure patch into an undirected graph, and forming a perturbation graph of the injected patch; selecting nodes belonging to a non-target category from the perturbation diagram as auxiliary nodes, calculating a loss function feature gradient after each auxiliary node is connected to a center node of the star-shaped structure patch, and aggregating the loss function feature gradients to obtain an aggregation gradient; the features of the false nodes are updated through multiple rounds of iteration, in each round of iteration, aggregation gradients are continuously and repeatedly generated and accumulated until a preset step number threshold value is reached, and feature updating is carried out on the false nodes corresponding to the maximum gradient; victim nodes are selected to be connected to the center node, node classification is conducted on the victim nodes through the graph convolutional network, and the attack success rate and the attack effect are determined based on the proportion that the victim nodes are classified into the target category. By adopting the scheme, the general attack on the graph data is realized.

Description

Technical Field

[0001] The present application relates to the field of graph representation learning technology, and in particular to a star-shaped adversarial patch attack method and device for graph convolutional networks. Background Art

[0002] Graphs are a universal representation that can be used to model data from biology, chemistry, social networks, recommender systems, and financial systems. Graph representation learning is one of the key areas of machine learning, involving multiple widely studied downstream tasks such as node classification, graph classification, link prediction, etc. For node classification tasks, graph neural networks, as a class of deep models designed specifically for graph-structured data, have achieved state-of-the-art performance. Among them, graph convolutional neural networks (GCNs), as the most representative graph neural network model, update the representation of the target node by aggregating the features of neighboring nodes, and have achieved better results on this task. Recent studies have shown that although deep models have achieved high achievements in prediction accuracy, they are vulnerable to adversarial manipulation of inputs, and graph neural networks also inherit this shortcoming. Attackers can generate adversarial perturbations of the graph by manipulating the structure or node features of the graph or injecting new nodes, thereby deceiving the graph neural network model. The inherent challenge of the lack of adversarial robustness of graph neural network models will continue to security-related fields. For example, in a credit scoring system, fraudsters can forge connections with several high-credit customers to evade fraud detection models. Fake articles on Wikipedia can be effectively disguised by appropriately modifying their links.

[0003] The vast majority of previous studies have reduced the classification accuracy of all nodes in the graph by modifying test data to mislead the training model, or by poisoning training data to weaken training. However, in many practical scenarios, controlling existing data has proven to be challenging. In contrast, injecting new nodes into graph data is more realistic. However, most existing graph injection attacks are not designed to conduct universal adversarial attacks. The perturbations they produce target a single node and cannot guarantee the effectiveness of adversarial attacks against all nodes. In addition, these false nodes are usually independent of each other and lack structural associations, which makes their attack effects more limited. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the first purpose of this application is to propose a star-shaped adversarial patch attack method for graph convolutional networks, which solves the technical problem that the attack effect of existing methods is relatively limited and realizes a universal attack on graph data.

[0006] The second objective of this application is to propose a star-shaped adversarial patch attack device for graph convolutional networks.

[0007] The third objective of the present application is to provide a computer device.

[0008] A fourth object of the present application is to provide a non-transitory computer-readable storage medium.

[0009] To achieve the above objectives, the first embodiment of the present application proposes a star-shaped adversarial patch attack method for a graph convolutional network, including:

[0010] Step S1: construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected to the central node of the star-shaped structure patch as connecting nodes to form a perturbation graph of the injected patch;

[0011] Step S2: Select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient;

[0012] Step S3: Update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, repeat step S2 to accumulate the aggregated gradients generated by the process until a preset step threshold is reached, and update the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradients.

[0013] Step S4: Select victim nodes from the perturbation graph and connect them to the central node of the star-shaped patch. Use the graph convolutional network to classify the victim nodes and output the classification results. The attack success rate and attack effect are determined based on the proportion of victim nodes classified as target categories.

[0014] Optionally, in one embodiment of the present application, constructing a star-shaped structure patch based on a false node with an empty feature includes:

[0015] The false nodes with empty features are connected in a star topology to form a star structure patch with the central node as the core and other nodes connected to the central node.

[0016] Optionally, in one embodiment of the present application, step S2 includes:

[0017] Select auxiliary nodes V belonging to non-target categories from the perturbation graph S , N S is the number of auxiliary nodes;

[0018] The disturbance features of the false nodes are calculated based on the auxiliary nodes, so that any victim nodes connected to the central node will be classified into the target category by the graph convolutional network. During the calculation, the solution process is converted into the solution of the optimization problem, which is:

[0019]

[0020] st‖E‖0+‖X F ‖0≤Δ

[0021] Among them, ‖E‖0 represents the number of edges between false nodes and between central nodes and connected nodes, ‖X F ‖0 represents the number of false node features, X F is the false node feature, Δ is the attack budget, is the cross entropy loss function of the auxiliary node,

[0022]

[0023] Among them, f(A′,X′) is the output of the graph convolutional network to the perturbation graph (A′,X′), is the target category c T The indicator function of

[0024] Solve the optimization problem, calculate the gradient of the cross entropy loss function of each auxiliary node with respect to the false node feature, and aggregate the gradients of all auxiliary nodes to obtain the aggregated gradient Grad cum , the aggregation gradient is expressed as:

[0025]

[0026] Among them, V S Auxiliary node.

[0027] Optionally, in one embodiment of the present application, updating the characteristics of the target false node includes:

[0028] Step S31: Initialize the accumulated gradient variable;

[0029] Step S32: Repeat step S2 to accumulate the generated aggregated gradients about the false node features into the accumulated gradient variable until a preset step number threshold is reached;

[0030] Step S33: Determine the feature index position of the maximum value in the cumulative gradient variable, and perform feature update on the target false node at the position.

[0031] Optionally, in one embodiment of the present application, the aggregated gradient is accumulated into a cumulative gradient variable, which is expressed as:

[0032] Gacc =G acc +Grad cum

[0033] Among them, G acc is the cumulative gradient variable, Grad cum is the aggregation gradient;

[0034] The formula for feature update is:

[0035]

[0036] Where (i,j) is the feature index position, i∈1,2,…,N T ×N F , j∈1,2,…,d.

[0037] Optionally, in one embodiment of the present application, step S4 includes:

[0038] Select the victim node from the perturbation graph and connect it with the central node of the star-shaped patch, update the adjacency matrix of the perturbation graph, and form the perturbed graph structure;

[0039] The perturbed graph structure is classified into nodes through a graph convolutional network, and the probability of each node being classified into each category is output;

[0040] The attack success rate is calculated based on the proportion of victim nodes classified as target categories, and the attack effect of the star-structured patch is evaluated based on the attack success rate.

[0041] To achieve the above-mentioned purpose, the second embodiment of the present invention proposes a star-shaped anti-patch attack device for a graph convolutional network, comprising:

[0042] A star-shaped structure patch construction module is used to construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected as connecting nodes to the central node of the star-shaped structure patch to form a perturbation graph of the injected patch.

[0043] A gradient calculation module is used to select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient;

[0044] The cumulative gradient and feature update module is used to update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, the gradient calculation module is repeatedly called to accumulate the aggregated gradients generated by the process until the preset step number threshold is reached, and the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradients are updated;

[0045] The attack execution module is used to select victim nodes from the perturbation graph and connect them to the central node of the star-shaped structure patch, use the graph convolutional network to classify the victim nodes, output the classification results, and determine the attack success rate and attack effect based on the proportion of victim nodes classified as target categories.

[0046] To achieve the above-mentioned purpose, the third aspect of the present invention proposes a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned star-shaped adversarial patch attack method for graph convolutional networks is implemented.

[0047] In order to achieve the above-mentioned objectives, the fourth aspect embodiment of the present invention proposes a non-temporary computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor, can execute the above-mentioned star-shaped adversarial patch attack method for graph convolutional networks.

[0048] The star-shaped adversarial patch attack method for graph convolutional networks in the embodiment of the present application constructs a star-shaped adversarial patch and injects false nodes into the graph data in a star-shaped structure. The star-shaped structure ensures the close connection between false nodes, improves the propagation effect of the disturbance, and combines the auxiliary node gradient aggregation technology to achieve a wide range of effective attacks. At the same time, when updating the feature disturbance, a multi-step cumulative gradient strategy is used to smooth the gradient fluctuations and improve the stability of the attack.

[0049] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0051] Figure 1 A schematic diagram of a flow chart of a star-shaped adversarial patch attack method for a graph convolutional network provided in Example 1 of the present application;

[0052] Figure 2 A schematic diagram of the structure of a star-shaped adversarial patch attack system for a graph convolutional network according to an embodiment of the present application;

[0053] Figure 3 A schematic diagram of the structure of a star-shaped anti-patch attack device for a graph convolutional network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0055] The problem to be solved in this application can be formally defined as: given a graph convolutional network (GCN) model f and an undirected attribute graph G = (A, X), A represents the adjacency matrix of the graph, X represents the node feature matrix, and d is the feature dimension. The goal is to design an attack method to obtain a universal adversarial patch so that most of the nodes in the graph can be classified into the predetermined target category C after adding this adversarial patch. T The model f is a two-layer GCN model, which is in the following form:

[0056]

[0057] in is the symmetric normalized adjacency matrix.

[0058] The following describes a star-shaped adversarial patch attack method and device for a graph convolutional network according to an embodiment of the present application with reference to the accompanying drawings.

[0059] Figure 1 A flowchart of a star-shaped adversarial patch attack method for a graph convolutional network provided in Example 1 of the present application.

[0060] like Figure 1 As shown in FIG. 1 , the star-shaped adversarial patch attack method for graph convolutional networks includes the following steps:

[0061] Step S1: construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected to the central node of the star-shaped structure patch as connecting nodes to form a perturbation graph of the injected patch;

[0062] Step S2: Select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient;

[0063] Step S3: Update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, repeat step S2 to accumulate the aggregated gradients generated by the process until a preset step threshold is reached, and update the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradients.

[0064] Step S4: Select victim nodes from the perturbation graph and connect them to the central node of the star-shaped patch. Use the graph convolutional network to classify the victim nodes and output the classification results. The attack success rate and attack effect are determined based on the proportion of victim nodes classified as target categories.

[0065] The star-shaped adversarial patch attack method for graph convolutional networks of the embodiment of the present application, first, constructs a star topology structure, generates a set of false nodes with empty features, selects one as the central node, and connects other false nodes to the central node to form a star structure. Then, the star patch is injected into the graph, and each connecting node is connected to the central node of the star structure. Next, the gradients of the connecting nodes and auxiliary nodes are calculated, and the features of the false nodes are updated by multi-step cumulative gradients. In each iteration, the feature position with the largest cumulative gradient is selected for update, and finally the false node feature matrix is ​​optimized to achieve a general attack effect. By evaluating the attack success rate (ASR), the general adversarial attack performance of this method in graph convolutional networks is effectively verified.

[0066] Optionally, in one embodiment of the present application, constructing a star-shaped structure patch based on a false node with an empty feature includes:

[0067] The false nodes with empty features are connected in a star topology to form a star structure patch with the central node as the core and other nodes connected to the central node.

[0068] In this implementation, the given undirected graph is:

[0069] G=(A,X)

[0070] Among them, the adjacency matrix A∈{0,1} N×N , feature matrix X∈{0,1} N×d ;

[0071] In the label category C T A set of connected nodes V is randomly selected from the node set T , expressed as:

[0072]

[0073] Among them, N T is the number of connected nodes;

[0074] In order to reduce the complexity of the attack, each connected node is required to connect to the same number N during the attack process. F The total number of fake nodes injected into the graph is N T ×N F , N T is the number of star structure patches, and the i-th star node patch corresponding to the i-th connection node is N Ffalse nodes, and the false node set is Central Node Adjacency Matrix Represents the central node With the rest N F -1 connection between fake nodes, represented by:

[0075]

[0076] Inject the star-shaped patch into the undirected graph to form a perturbation graph of the injected patch, including:

[0077] Connect each connection node to the corresponding central node of the star topology, and define the connection point between each connection node and the corresponding central node as:

[0078] Injection N T The perturbation graph of the patch is:

[0079] G′=(A′,X′)

[0080] in,

[0081] Injection N T After the star structure, the adjacency matrix A′ can be expressed as a block diagonal matrix, which contains the adjacency matrix A and the adjacency matrix of all star structure patches. And add the connection between the connecting node and the central node, A′ is expressed as:

[0082]

[0083] in, and Is a connection node and central node The unit vector of , which represents the connection between the connecting node and the star structure,

[0084] The false node feature is initially empty, i.e. Represents the false node features of the i-th star structure, and the feature matrix X′ is:

[0085]

[0086] Optionally, in one embodiment of the present application, step S2 includes:

[0087] In the case of not belonging to target category C T A set of nodes is randomly selected from the nodes As the set of auxiliary nodes, N S Indicates the number of auxiliary nodes;

[0088] According to the auxiliary node set V S Calculate the perturbation features of the patch node so that any victim node connected to the patch center node will be classified as the target class by the classifier. The above problem can be formulated as an optimization problem. For each auxiliary node v∈V S Using the cross entropy loss function:

[0089]

[0090] Among them, f(A′,X′) is the output of the graph convolutional network to the perturbation graph (A′,X′), It is category c T The indicator function of . Next, the optimization problem is expressed as follows:

[0091]

[0092] st‖E‖0+‖X F ‖0≤Δ

[0093] ‖E‖0 represents the number of edges between fake nodes and between central nodes and connected nodes, which is equivalent to the number of fake nodes injected into the original graph. ‖X F ‖0 represents the number of false node features, and Δ is the attack budget. To achieve the optimization goal, the loss function needs to be calculated About the false node feature X F The gradient of the auxiliary nodes is aggregated. For all auxiliary nodes v∈V T , the aggregation gradient can be expressed as:

[0094]

[0095] Optionally, in one embodiment of the present application, multi-step cumulative gradients are used to perform iterative feature updating, including:

[0096] First, initialize a cumulative gradient variable G acc , used to store the accumulated gradient values ​​calculated in each iteration. Then in each iteration, according to the second step, the false node feature X is obtained F Aggregation gradient Grad cum , and accumulate it to G acc Specifically, it can be expressed as:

[0097] G acc =G acc +Grad cum

[0098] When the predetermined step number threshold T is reached, the feature is updated. The updating method is to select the feature index position (i, j) with the largest value in the cumulative gradient matrix and replace the false node feature value X at that position with F (i,j) is modified from 0 to 1 to maximize the perturbation effect of the adversarial patch. The formula for feature update is:

[0099]

[0100] Where i∈1,2,…,N T ×N F ,j∈1,2,…,d. In particular, if the position corresponding to the maximum gradient in a certain iteration is 1, then find the second largest gradient position. After updating the feature, clear the accumulated gradient G acc , which completes one iteration. Perform multiple rounds of iterative updates until the predetermined number of characteristic perturbations ‖X is obtained. F ‖0 stops, and finally a fully optimized perturbation graph G′=(A′,X′) will be generated.

[0101] Optionally, in one embodiment of the present application, step S4 includes:

[0102] Based on the constructed star-shaped adversarial patch, the victim nodes in the graph are attacked, and the graph convolutional network model f is used to classify the nodes. First, the selected victim nodes are connected to the central node of the star-shaped adversarial patch, and the adjacency matrix A′ of the graph is updated to form the perturbed graph structure. Then, the updated graph G′=(A′,X′) is classified by model f, and the probability of each node being classified into each category is output. Next, the attack effect of the star-shaped adversarial patch is evaluated by calculating the attack success rate (ASR), that is, the proportion of victim nodes classified into the target category after the attack. A high ASR indicates a high attack success rate, indicating that most victim nodes are successfully misclassified as the target category, thereby verifying the effectiveness of the adversarial patch.

[0103] This embodiment verifies the attack effect through experiments, and the experimental results include:

[0104] (1) Attack success rate (ASR) for different target categories under different connection nodes Number of false nodes N F =3, the number of auxiliary nodes N S =20, characteristic perturbation budget ‖X F ‖0=25, step threshold T=2.

[0105] Table 1

[0106]

[0107]

[0108] (2) Comparison with other baseline methods

[0109] Table 2

[0110]

[0111] When the connection node is 1,

[0112] Table 3

[0113]

[0114] Without-G acc Update for features without multi-step accumulation.

[0115] The present application also provides a star-shaped adversarial patch attack system for graph convolutional networks, such as Figure 2 As shown, including:

[0116] Step 1: Input module. Responsible for receiving graph data, target categories, and attack-related parameters. These inputs will be used in the subsequent patch construction and attack execution process.

[0117] Step 2: Star-shaped adversarial patch construction module. In this module, fake nodes are generated according to the received parameters and a star-shaped topology is constructed. The connection between the fake nodes and the central node forms a star-shaped patch, which is then injected into the graph.

[0118] Step 3: Gradient calculation module. Calculate the gradient of the objective function with respect to the features of the fake nodes and process the gradient information of the auxiliary nodes. These gradients are used to optimize the features of the adversarial patch.

[0119] Step 4: Accumulated gradient and feature update module. Accumulate the calculated gradients and perform multiple iterations to update the features of the fake nodes. This optimizes the effect of the adversarial patch.

[0120] Step 5: Attack execution module: Use the graph convolutional network (GCN) to classify the nodes of the graph containing the adversarial patch, calculate the attack success rate, and output the classification results.

[0121] In order to implement the above embodiments, the present application also proposes a star-shaped adversarial patch attack device for graph convolutional networks.

[0122] Figure 3 A schematic diagram of the structure of a star-shaped anti-patch attack device for a graph convolutional network provided in an embodiment of the present application.

[0123] like Figure 3 As shown, the star-shaped adversarial patch attack device for graph convolutional networks includes:

[0124] A star-shaped structure patch construction module is used to construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected as connecting nodes to the central node of the star-shaped structure patch to form a perturbation graph of the injected patch.

[0125] A gradient calculation module is used to select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient;

[0126] The cumulative gradient and feature update module is used to update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, the gradient calculation module is repeatedly called to accumulate the aggregated gradients generated by the process until the preset step number threshold is reached, and the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradients are updated;

[0127] The attack execution module is used to select victim nodes from the perturbation graph and connect them to the central node of the star-shaped structure patch, use the graph convolutional network to classify the victim nodes, output the classification results, and determine the attack success rate and attack effect based on the proportion of victim nodes classified as target categories.

[0128] It should be noted that the aforementioned explanation of the embodiment of the star-shaped adversarial patch attack method for a graph convolutional network is also applicable to the star-shaped adversarial patch attack device for a graph convolutional network of this embodiment, and will not be repeated here.

[0129] In order to implement the above embodiments, the present invention further proposes a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method described in the above embodiments is implemented.

[0130] In order to implement the above embodiments, the present invention further proposes a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method of the above embodiments is implemented.

[0131] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0132] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0133] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0134] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0135] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0136] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0137] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0138] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A star-shaped adversarial patch attack method for graph convolutional networks, characterized in that: include: Step S1: construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected to the central node of the star-shaped structure patch as connecting nodes to form a perturbation graph of the injected patch; Step S2: Select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient; Step S3: Update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, repeat step S2 to accumulate the aggregated gradients generated by the process until a preset step threshold is reached, and update the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradients. Step S4: Select victim nodes from the perturbation graph and connect them to the central node of the star-shaped patch. Use a graph convolutional network to classify the victim nodes, output the classification results, and determine the attack success rate and attack effect based on the proportion of victim nodes classified as target categories.

2. The method according to claim 1, characterized in that The star-shaped structure patch is constructed based on the false node with empty features, comprising: The false nodes with empty features are connected with each other in a star topology to form a star structure patch with the central node as the core and other nodes connected to the central node.

3. The method according to claim 1, characterized in that The step S2 comprises: Select auxiliary nodes V belonging to non-target categories from the perturbation graph S , N S is the number of auxiliary nodes; The disturbance features of the false nodes are calculated based on the auxiliary nodes, so that any victim nodes connected to the central node will be classified into the target category by the graph convolution network. During the calculation, the solution process is converted into the solution of the optimization problem, which is: s.t.‖E‖0+‖X F ‖0≤Δ Among them, ‖E‖0 represents the number of edges between false nodes and between central nodes and connected nodes, ‖X F ‖0 represents the number of false node features, X F is the false node feature, Δ is the attack budget, is the cross entropy loss function of the auxiliary node, Among them, f(A′,X′) is the output of the graph convolutional network to the perturbation graph (A′,X′), is the target category c T The indicator function of The optimization problem is solved, and the gradient of the cross entropy loss function of each auxiliary node with respect to the false node feature is calculated during the solution, and the gradients of all auxiliary nodes are aggregated to obtain the aggregated gradient Grad cum , the polymerization gradient is expressed as: Among them, V S Auxiliary node.

4. The method according to claim 1, characterized in that Update the characteristics of the target fake node, including: Step S31: Initialize the accumulated gradient variable; Step S32: Repeat step S2 to accumulate the generated aggregated gradients about the false node features into the accumulated gradient variable until a preset step number threshold is reached; Step S33: Determine the feature index position of the maximum value in the cumulative gradient variable, and perform feature update on the target false node at the position.

5. The method according to claim 4, characterized in that Accumulate the aggregated gradient into the accumulated gradient variable, expressed as: G acc =G acc +Grad cum Among them, G acc is the cumulative gradient variable, Grad cum is the aggregation gradient; The formula for feature update is: Where (i,j) is the feature index position, i∈1,2,…,N T ×N F , j∈1,2,…,d.

6. The method according to claim 1, characterized in that The step S4 comprises: Select the victim node from the perturbation graph and connect it with the central node of the star-shaped patch, update the adjacency matrix of the perturbation graph, and form the perturbed graph structure; The perturbed graph structure is classified into nodes through a graph convolutional network, and the probability of each node being classified into each category is output; The attack success rate is calculated based on the proportion of victim nodes classified as target categories, and the attack effect of the star-structured patch is evaluated based on the attack success rate.

7. A star-shaped adversarial patch attack device for graph convolutional networks, characterized in that: include: A star-shaped structure patch construction module is used to construct a star-shaped structure patch based on a false node with an empty feature, and inject the star-shaped structure patch into an undirected graph. During the injection, nodes belonging to the target category selected from the undirected graph are connected as connecting nodes to the central node of the star-shaped structure patch to form a perturbation graph of the injected patch. A gradient calculation module is used to select nodes belonging to non-target categories from the perturbation graph as auxiliary nodes, calculate the loss function feature gradient after each auxiliary node is connected to the central node of the star-shaped structure patch, and aggregate all loss function feature gradients to obtain an aggregated gradient; The cumulative gradient and feature update module is used to update the features of the false nodes through multiple rounds of iterations until the maximum number of disturbances is reached. In each round of iteration, the gradient calculation module is repeatedly called to accumulate the aggregated gradient generated by the process until a preset step number threshold is reached, and the features of the false nodes corresponding to the maximum gradient in the accumulated aggregated gradient are updated; The attack execution module is used to select victim nodes from the perturbation graph and connect them to the central node of the star-shaped structure patch, use a graph convolutional network to classify the victim nodes, output the classification results, and determine the attack success rate and attack effect based on the proportion of victim nodes classified as target categories.

8. A computer device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images