Verifiable defense algorithm for graph data escape attack
By designing a verifiable defense algorithm based on discrete diffusion denoising model in graph neural networks, the problem that the prior art cannot provide effective defense under unknown attacks and unknown models is solved, and a balance of high security and ease of use is achieved.
Patent Information
- Application Number
- CN202411479018.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2025-03-28
AI Technical Summary
The prior art cannot provide effective defense for graph neural networks in the case of unknown attacks, unknown model architectures and unknown model parameters, and cannot guarantee high security and ease of use at the same time.
A verifiable defense algorithm based on discrete diffusion denoising model is designed to provide defense against graph data evasion attacks by extracting subgraphs, adding randomized noise, using discrete diffusion denoising model, and constructing robust certificates.
In the case of unknown attacks and unknown models, deterministic protection is provided to ensure the correctness of the classification results of graph neural networks, and is easy to apply to different model architectures and parameter settings.
Smart Images
Figure CN119720190A_ABST
Abstract
Description
Technical Field
[0001] The present invention designs a verifiable defense algorithm for graph data evasion attacks, which belongs to the field of security of graph neural networks. Background Art
[0002] Graph-structured data has been widely used in social networks, transaction networks, recommendation systems and other fields. For example, in social networks, the nodes of the graph represent social users, and the edges of the graph represent the associations between users. In such networks, it is necessary to identify and analyze entity nodes based on the relationships between entities. For example, in social networks, it is necessary to identify users as real users or water army users. Such problems can be abstracted as node classification problems on graph data. Graph neural network (GNN) uses machine learning methods and has achieved good results in node classification tasks.
[0003] However, as the accuracy of graph neural networks improves, studies have found that slight perturbations to the input graph data can cause errors in the model's prediction results. For example, malicious nodes in social networks can cause target users to be misidentified by the user detection model based on graph neural networks by modifying their own behavior and maliciously interacting with other users. This type of attack is called an evasion attack. An evasion attack occurs in the prediction stage of a graph neural network. The attacker causes the graph neural network to output incorrectly by modifying the node features and adjacency matrix of the input graph.
[0004] Existing defense methods against evasion attacks on graph neural networks can be divided into two categories: heuristic defense and verifiable defense, among which verifiable defense can be further divided into specific model defense and general model defense. Existing defense methods can effectively defend against some evasion attacks, but they still have limitations and cannot achieve a balance between security and ease of use. Specifically: 1) Heuristic defense cannot defend against unknown attacks. Heuristic defense methods usually detect and modify malicious data or improve model robustness by analyzing attack patterns. Although such empirical methods can have a defensive effect on certain specific attacks, they cannot defend against unknown attacks. Verifiable defense is effective against any attack. It can ensure that if the attack does not exceed certain constraints, the classification result of the model must be correct. However, existing verifiable defense methods still have shortcomings. Specifically, 2) Specific model verifiable defense cannot be applied to multiple models. Such methods usually use optimization-based methods to provide verifiable defense for graph neural networks with specific architectures (such as graph convolutional neural networks), and cannot be generalized to different models. 3) General model verifiable defense cannot be applied to black box neural networks. The commonly used general model defense method is randomized smoothing. This method obtains the result by adding randomized noise to the input data and using a "smoothed" model for classification. However, the coupling between the classification model and the data randomization causes this method to require graph neural networks for data augmentation training, which is not suitable for pure black box models.
[0005] Existing defense methods for graph data node classification tasks cannot provide both high security (defense against unknown attacks) and ease of use (applicable to models with unknown architectures and unknown parameters). The problem of providing defense for graph neural networks in the case of unknown attacks and unknown models remains unsolved.
[0006] To this end, a provable defense algorithm is designed against graph data evasion attacks to overcome the above problems. Summary of the invention
[0007] In view of the problem that the existing technology cannot take into account both security and ease of use, the present invention constructs a graph denoiser based on a discrete diffusion denoising model, and designs a verifiable defense algorithm for graph neural networks in black box scenarios. The purpose of the present invention is to provide deterministic protection in pure black box scenarios with unknown attacker strategies and capabilities, and unknown neural network model architectures and parameters. The present invention utilizes the generation capability of the diffusion model to design a graph-oriented diffusion denoising and denoising process, model the complex dependencies between the structure of the graph and node features, learn the features of the graph, and reconstruct graph examples belonging to the source data distribution from noise samples for downstream classification tasks. The present invention theoretically proves the verifiable defense provided and provides deterministic classification guarantees under the corresponding attack budget.
[0008] The present invention is implemented by the following technical solution: a verifiable defense algorithm for graph data evasion attacks, comprising the following steps:
[0009] Step 1, extract subgraph: For the input graph G and the target node v to be classified, we extract the L-hop subgraph G′ of the target node as the input of the denoising model, the purpose of which is to reduce the scale of data processed by the diffusion model;
[0010] Step 2, add randomized noise: For subgraph G′, add random discrete Bernoulli noise Get the noisy subgraph G t , where p + and p - They represent the probability of 1-bit and 0-bit inversion in the adjacency matrix and feature matrix of the graph, respectively. The value is determined by the marginal distribution of 1-bit and 0-bit in the original data distribution and the timestamp t of the diffusion model.
[0011] Step 3: Subgraph denoising based on discrete diffusion denoising model: For the diffusion subgraph G containing noise t ,Use the graph denoising model based on the discrete diffusion denoising model to denoise and reconstruct the noise-free sample
[0012] Step 4, graph neural network classification: for the input denoised subgraph And the target node v, use any black box graph neural network to classify and predict the label y;
[0013] Step 5, construct a robustness certificate: repeat steps 2, 3, and 4 n times to obtain the classification result Y of n denoised subgraphs, and use the discrete Neyman-Pearson lemma to obtain the proof of the robust radius.
[0014] As a preferred embodiment: in step 2, for the subgraph G ′ Add random Bernoulli noise to the feature matrix X′ and adjacency matrix A′, and the probability of Bernoulli distribution satisfies and Adopt cosine noise planning.
[0015] As a preferred embodiment: in step 3, a denoising network is designed based on a discrete diffusion model It consists of two parts: and Predict the noise added to the feature matrix X and the adjacency matrix A respectively.
[0016] As a preferred embodiment: in step 3, a multi-layer perceptron is used to implement Implementation using message passing graph neural network
[0017] As a preference: in step 3, a weighted cross entropy loss function is designed
[0018] Preferably, in step 5, the input image space is divided into non-overlapping sub-regions satisfying a constant likelihood ratio. And construct and Use the discrete Neyman-Pearson lemma to prove a lower bound on the most likely class and an upper bound on the next most likely class.
[0019] The beneficial effects of the present invention are as follows:
[0020] 1) Use random smoothing to provide verifiable defense for node classification graph neural networks, which can resist unknown attacks; 2) Use a graph denoiser based on a discrete diffusion denoising model to "purify" random samples, avoiding robust training of data enhancement for graph neural networks, and can provide defense for any black box model; 3) Decouple the randomization of the training process and the prediction process, and use a graph denoiser to defend against random noise of different amplitudes and adversaries with different attack budgets. The experimental results on the graph dataset show that the defense algorithm of the present invention can effectively defend against evasion attacks, and graph neural networks using a variety of architectures have high classification accuracy and verifiable accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Figure 1 It is a schematic diagram of the overall process of the present invention. DETAILED DESCRIPTION
[0022] In order to enable those skilled in the art to more clearly understand the objectives, technical solutions and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments.
[0023] In the description of the present invention, it is necessary to understand that the orientation or position relationship indicated by the terms such as "up", "down", "left", "right", "inside", "outside", "horizontal" and "vertical" is based on the orientation or position relationship shown in the accompanying drawings, and is only for the convenience of describing the present invention, rather than indicating or implying that the device or original referred to must have a specific orientation, and therefore cannot be understood as a limitation on the present invention.
[0024] The present invention will be described in detail below with reference to the accompanying drawings: Figure 1 As shown, a verifiable defense algorithm for graph data evasion attacks includes the following steps:
[0025] A verifiable defense algorithm for graph data evasion attacks, comprising the following steps:
[0026] Step 1, extract subgraph: For the input graph G and the target node v to be classified, we extract the L-hop subgraph G′ of the target node as the input of the denoising model, the purpose of which is to reduce the scale of data processed by the diffusion model;
[0027] Step 2, add randomized noise: For subgraph G′, add random discrete Bernoulli noise Get the noisy subgraph G t , where p + and p - They represent the probability of 1-bit and 0-bit inversion in the adjacency matrix and feature matrix of the graph, respectively. The value is determined by the marginal distribution of 1-bit and 0-bit in the original data distribution and the timestamp t of the diffusion model.
[0028] Step 3: Subgraph denoising based on discrete diffusion denoising model: For the diffusion subgraph G containing noise t ,Use the graph denoising model based on the discrete diffusion denoising model to denoise and reconstruct the noise-free sample
[0029] Step 4, graph neural network classification: for the input denoised subgraph And the target node v, use any black box graph neural network to classify and predict the label y;
[0030] Step 5, construct a robustness certificate: repeat steps 2, 3, and 4 n times to obtain the classification result Y of n denoised subgraphs, and use the discrete Neyman-Pearson lemma to obtain the proof of the robust radius.
[0031] In step 2, random Bernoulli noise is added to the feature matrix X′ and the adjacency matrix A′ of the subgraph G′. The probability of the Bernoulli distribution satisfies and Adopt cosine noise planning.
[0032] In step 3, a denoising network is designed based on a discrete diffusion model. It consists of two parts: and Predict the noise added to the feature matrix X and the adjacency matrix A respectively.
[0033] In step 3, a multi-layer perceptron is used to implement Implementation using message passing graph neural network
[0034] In step 3, a weighted cross entropy loss function is designed
[0035] In step 5, the input image space is divided into non-overlapping sub-regions that satisfy a constant likelihood ratio. And construct and Use the discrete Neyman-Pearson lemma to prove a lower bound on the most likely class and an upper bound on the next most likely class.
[0036] In step 2 of the above method, we respectively ′ Add random Bernoulli noise to the feature matrix X′ and adjacency matrix A′ and Probability of Bernoulli Distribution and They represent the probability of a 0 bit flipping to a 1 bit and the probability of a 1 bit flipping to a 0 bit in the data. Specifically, in the feature matrix, they represent the change in the 0 / 1 value of a certain dimension feature, and in the adjacency matrix, they represent the change in the existence of the edge in the graph. In the diffusion model, for variable Z, at time stamp t z The amplitude of the noise added when the timestamp increases, and the amplitude of the noise gradually increases until the timestamp reaches the set value T z , the data becomes pure noise. In the actual experiment, cosine noise planning is used. and They represent the ratio of 1 bit to 0 bit in the original data, respectively, and determine that the pure noise finally obtained by diffusion is Bernoulli noise satisfying Ber(p=m1).
[0037] In step 3 of the above method, we designed a graph denoising model based on the discrete denoising diffusion model as a denoiser for randomised graphs. In the diffusion model, the forward process gradually adds noise to the sample until it becomes a pure noise state, and the reverse process trains a denoising network to remove the added random noise and reconstruct the sample.
[0038] Specifically, for the undirected graph G = (X, A) of binary features, the discrete forward noise addition process can be written as:
[0039]
[0040] where Cat(Z; p = p Z ) indicates that the variable Z satisfies p=p Z The category distribution of . and Respectively represent the timestamp t x and t a The features and adjacency matrix of X0 and A0 are the input samples of the diffusion model, which are the subgraph G extracted in step 1 in the present invention. ′ .
[0041] The discrete inverse denoising process trains a denoising network to predict the noise added to the sample. The denoising network needs to simultaneously predict and The present invention designs a joint denoising network Used to model the complex relationship between node features X and connecting edges A in the graph and estimate the joint noise expectation The goal of the denoising network is to minimize the regression loss:
[0042]
[0043] Our denoising network It consists of two parts: and We use a multi-layer perceptron (MLP) to implement Prediction node feature noise Implemented using Message-Passing Neural Network (MPNN) Predicting Reconstruction Node Features Adjacency matrix noise under the condition of
[0044] We use the cross-up loss to train the denoising network. Specifically, the loss function is:
[0045]
[0046] Where λ controls the importance of the connecting edge A in the graph relative to the node feature X. In the formula and Represents the noise probability distribution of the denoising network output.
[0047] In step 5 above, we use the Monte Carlo method to sample multiple random graphs for denoising, and construct a robustness certificate based on the prediction results of n denoised samples. The basic idea of constructing a robustness certificate is: if the graph neural network f θ For a random sample φ(G) output label y, prove that when receiving When used as input, the label y is still output. For any graph neural network, given the randomization method as in step 2, the goal is to find a robust radius Δ = maxδ (corresponding to the adversary budget) that satisfies:
[0048]
[0049] Since graph neural networks are usually nonlinear, the above probabilities are difficult to calculate. We prove that there is a most likely category y * The probability lower bound of p y* and an upper bound on the next possible class y satisfy:
[0050]
[0051] We first divide the input graph space into disjoint subregions satisfying constant likelihood ratio satisfy Then build the region and satisfy and We will sub-area Add to in order of decreasing likelihood ratio , the sub-regions are divided into Add to Then constructing a robustness certificate is equivalent to solving a linear programming problem:
[0052]
[0053] Where f is the graph neural network we are solving, and the vector r satisfies Build Area and The process is equivalent to using a greedy algorithm to solve the above problem. We can calculate the robustness proof in each sub-region The maximum perturbation of , i.e. the robust radius Δ, is used to obtain the robustness certificate.
[0054] The verifiable defense method proposed in the present invention can provide defense for node classification graph neural networks under unknown attacks, unknown model architectures, and unknown model parameters.
[0055] The advantages of the verifiable defense algorithm of the present invention are reflected in: 1) complete functions, which can still provide defense against graph data evasion attacks under the premise that the attacker can adopt any attack strategy; 2) high ease of use, which can provide verifiable defense when the protected graph neural network is a pure black box oracle; 3) good portability, a graph denoising model can be applied to any graph neural network, any noise amplitude, any combination of node feature noise and structural noise amplitude; 4) high availability, which can ensure high classification accuracy while providing verifiable defense.
[0056] The specific embodiments described herein are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed by the present invention shall still be covered by the claims of the present invention.
Claims
1. A verifiable defense algorithm against graph data evasion attacks, characterized in that: The following steps are involved: Step 1, extract subgraph: for the input graph G and the target node v to be classified, extract the L-hop subgraph G′ of the target node as the input of the denoising model, the purpose of which is to reduce the scale of data processed by the diffusion model; Step 2, add randomized noise: For subgraph G′, add random discrete Bernoulli noise Get the noisy subgraph G t , where p + and p - They represent the probability of 1-bit and 0-bit inversion in the adjacency matrix and feature matrix of the graph, respectively. The value is determined by the marginal distribution of 1-bit and 0-bit in the original data distribution and the timestamp t of the diffusion model. Step 3: Subgraph denoising based on discrete diffusion denoising model: For the diffusion subgraph G containing noise t ,Use the graph denoising model based on the discrete diffusion denoising model to denoise and reconstruct the noise-free sample Step 4, graph neural network classification: for the input denoised subgraph And the target node v, use any black box graph neural network to classify and predict the label y; Step 5, construct a robustness certificate: repeat steps 2, 3, and 4 n times to obtain the classification result Y of n denoised subgraphs, and use the discrete Neyman-Pearson lemma to obtain the proof of the robust radius.
2. The provable defense algorithm against graph data evasion attacks according to claim 1, characterized in that: In step 2, the subgraph G ′ Add random Bernoulli noise to the feature matrix X′ and adjacency matrix A′, and the probability of Bernoulli distribution satisfies and Adopt cosine noise planning.
3. The provable defense algorithm against graph data evasion attacks according to claim 1, characterized in that: In step 3, a denoising network is designed based on a discrete diffusion model. It consists of two parts: and Predict the noise added to the feature matrix X and the adjacency matrix A respectively.
4. The provable defense algorithm against graph data evasion attacks according to claim 1, characterized in that: In step 3, a multi-layer perceptron is used to implement Implementation using message passing graph neural network 5. The provable defense algorithm against graph data evasion attacks according to claim 1, characterized in that: In step 3, a weighted cross entropy loss function is designed 6. The provable defense algorithm against graph data evasion attacks according to any one of claims 1 to 5, characterized in that: In step 5, the input image space is divided into non-overlapping sub-regions satisfying a constant likelihood ratio. And construct and Use the discrete Neyman-Pearson lemma to prove a lower bound on the most likely class and an upper bound on the next most likely class.