Neurograph database system with privacy protection function and method of using the same

Abstract

This invention provides a privacy-preserving neural graph database system for receiving user-input queries and providing answers. The system includes: a user query input receiver, a graph builder module, a query encoder model, a privacy risk identifier, a score calculator engine, and an answer output module. The user query input receiver captures the input query in a structured language. The graph builder module provides a computational graph based on the query and constructs it as a directed acyclic graph, where edges represent operations on entities and attributes. The query encoder model converts the query into a vector format. The answer retrieval module receives the vector format of the query and retrieves a set of candidate answers. The privacy risk identifier categorizes the results into a public answer set and a private answer set, and marks potential privacy leakage risks. The score calculator engine evaluates these sets using a loss function. The answer output module selects the final answer based on these evaluation results.

Description

Technical Field

[0001] This invention relates to a privacy-preserving neural graph database (P-NGDB) system and its usage method, thereby mitigating the risk of privacy leakage in neural graph databases (NGDB). Background Technology

[0002] Graph databases play a crucial role in storing, organizing, and retrieving structured relational information and are widely used in downstream applications such as recommender systems and fraud detection. However, traditional graph databases are often limited by incomplete graphs, a common problem in real-world knowledge graphs, such as the Freebase system. Because graph databases may not be able to capture all necessary relationships and connections between entities through traversal, this incompleteness leads to the exclusion of relevant results.

[0003] To address these shortcomings, Neural Graph Databases (NGDBs) extend the concept of graph databases by combining the flexibility of graph data models with the computational power of neural networks, enabling efficient modeling, storage, and analysis of interconnected data. NGDBs provide unified storage for different entities in an embedded space and achieve expressive and intelligent query results, reasoning results, and knowledge mining results through graph-based neural network technology. This capability, known as complex query answering (CQA), aims to identify answers that satisfy a given logical expression.

[0004] Logical expressions are typically defined in predicate logic form and include relational projection operations and existential quantifiers. Logical conjunction (∧), disjunction (∨), etc. The logical form of q includes terms such as Win(V, Turing Award) and logical operators such as conjunction (∧), which can express queries such as "find where the Turing Award winner born in 1960 lives".

[0005] Query encoding methods are commonly used in Complex Query Response (CQA) and involve parameterizing entities, relations, and logical operators while encoding the query and entities into the same embedding space. The answer is then retrieved based on the similarity between the query embedding and the entity embedding. For example, methods like GQE and query2box can encode queries as vectors and hyperrectangles, respectively.

[0006] While NGDB has achieved significant success across various fields, it does face unique privacy challenges compared to traditional graph databases. One notable risk is its generalization capability. While this capability effectively handles incomplete knowledge graphs and enriches retrieval information, it also allows attackers to exploit combinations of complex queries to extract sensitive information from NGDB.

[0007] Figure 1 A structural diagram of NGDB is presented. NGDB allows retrieval of answers to complex logical queries on an incomplete graph. However, because graph information is stored in the embedding space and a query engine designed to answer complex logical queries is employed, privacy issues may arise. To illustrate this, consider an example scenario where an attacker attempts to infer private information about Hinton's residence from NGDB. Privacy risk detection can easily detect this by directly querying for privacy; however, an attacker can also leverage combinations of multiple queries to retrieve the desired privacy information.

[0008] More specifically, such as Figure 1 As shown, information about an individual's (in this case, Hinton's) place of residence is considered private information. Even if Hinton's address is omitted when constructing the knowledge graph, or if direct privacy queries are restricted, malicious attackers can still infer sensitive information without directly querying Hinton's place of residence. For example, by querying NGDB for the places of residence of Turing Award winners born before 1950 and after 1940, or the places of LeCun's collaborators. The intersection of these query results still has a high probability of revealing Turing Award winner Hinton's place of residence.

[0009] Furthermore, graph privacy has always been a significant concern in graph research. Numerous studies have demonstrated that graph neural networks are vulnerable to various privacy breaches. For example, graph embeddings are susceptible to attribute inference attacks and link prediction attacks, leading to the development of various protection methods. However, these works focus on graph representation learning and assume that attackers have access to graph embeddings, which is not a typical scenario in NGDB. NGDB typically provides complex query-response services and does not publish learned embedding representations, meaning attackers can only infer privacy using pre-designed queries. Moreover, these works only investigate node classification and link prediction problems, without exploring query-response privacy within NGDB.

[0010] Therefore, since the privacy issues related to query answers in the NGDB domain have not yet been resolved, there is a need for an improved privacy protection method that can enhance graph privacy for neural graph databases while providing high-quality, publicly available answers to queries. Summary of the Invention

[0011] The purpose of this invention is to provide a system and method to solve the aforementioned problems existing in the prior art.

[0012] This disclosure reveals the potential privacy risks of Neural Graph Databases (NGDBs) through formal definition and evaluation. Within the existing NGDB architecture, this invention introduces a privacy protection objective, dividing the answers to complex queries in the knowledge graph into privacy and public domains. To protect privacy information in the knowledge graph, NGDB should maintain high-quality retrieval of non-privacy answers to queries as much as possible, while intentionally obfuscating correct but privacy-threatening answers involving privacy queries. For example, the answer set corresponding to a query posed by a privacy attacker can be obfuscated, making it more challenging for the attacker to predict privacy information, thereby effectively protecting the privacy of NGDB. Furthermore, corresponding privacy protection evaluation benchmarks are created on three datasets (e.g., Freebase, YAGO, and DBpedia) to evaluate the performance of Complex Query Responses (CQA) in terms of public query answer quality and privacy information protection.

[0013] To mitigate the privacy leakage problem in NGDB, this invention proposes a Privacy-Preserving Neural Graph Database (P-NGDB) as one solution. P-NGDB divides the information in the graph database into private and public parts, and categorizes the answers to complex queries based on relevant privacy risks, specifically whether sensitive information is involved. P-NGDB can provide answers with different levels of accuracy for queries with varying privacy risks. During the training phase of P-NGDB, adversarial techniques can be introduced to make the system generate indistinguishable answers when queries use private information, thereby increasing the difficulty of inferring privacy through complex privacy queries. The main contributions of this invention are summarized as follows:

[0014] (1) The solution provided offers innovative results on the privacy leakage problem of complex queries in the research of Neural Graph Database (NGDB), and provides specific definitions on the privacy protection issue in the same field.

[0015] (2) Based on the three public datasets provided, a benchmark is proposed to simultaneously evaluate the complex query capability (CQA) and privacy protection capability in NGDB.

[0016] (3) A framework called P-NGDB for protecting NGDB privacy was introduced. Extensive experiments were conducted on three datasets, and the results show that the adopted framework effectively maintains high information retrieval performance while ensuring privacy protection.

[0017] According to a first aspect of the invention, a system for a privacy-preserving neural graph database is provided for receiving queries from user input and providing answers to the user in response to the queries. The system includes: a user query input receiver, a graph builder module, a query encoder model, an answer retrieval module, a privacy risk identifier, a score calculation engine, and an answer output module. The user query input receiver serves as a user interface, receiving a structured query language from the user and treating it as the input query. The graph builder module receives the query from the user query input receiver and constructs a computational graph to convert the query into a directed acyclic graph, where edges represent operations on sets of entities and attributes. The query encoder model receives the query graph associated with the computational graph from the graph builder module to process the query graph, wherein the query encoder model is configured to convert the query graph into a vector format. The answer retrieval module receives the vector format of the query graph from the query encoder model and retrieves a set of candidate answers, wherein the information output by the answer retrieval module represents the set of answers containing entities or values ​​retrieved by the computational graph. A privacy risk identifier receives information output by the answer retrieval module, determines whether the answer set has privacy risks, checks sensitive information, and marks queries that lead to privacy leaks. The privacy risk identifier also divides the answer set in the computational graph into a public answer set and a private answer set. A score calculation engine receives the public and private answer sets, calculates their probabilities using corresponding loss functions, and calculates a score for each candidate answer. The score calculation engine assigns a low threshold to the loss function of the public answer set, requiring the calculated result of the loss function for the public answer set to be below the threshold, and assigns a high threshold to the loss function of the private answer set, requiring the calculated result of the loss function for the private answer set to be above the threshold. An answer output module refers to the result of the loss function and combines it with the thresholds to select the final answer to the original input query.

[0018] According to a second aspect of the present invention, a method for a privacy-preserving neural graph database is provided for receiving queries from user input and providing answers to the user in response to the queries. The method includes the following steps: receiving a structured query language input from a user via a user query input receiver, treating it as a query; constructing a computational graph via a graph builder module to convert the query into a directed acyclic graph, where edges represent operations on entities and attribute sets; encoding the query graph associated with the computational graph into a vector format via a query encoder model; retrieving a candidate answer set from the vector format of the query graph via an answer retrieval module, wherein the information output by the answer retrieval module represents the answer set of entities or values ​​retrieved by the computational graph; determining whether the answer set contains any privacy risks, checking sensitive information, and marking queries that lead to privacy breaches via a privacy risk identifier; and further retrieving the query from the privacy risk identifier. A risk identifier categorizes the answer set from the computational graph into a public answer set and a private answer set; a score calculation engine calculates the probability of the public answer set and the private answer set using corresponding loss functions, and calculates a score for each candidate answer, wherein the score calculation engine assigns a low threshold to the loss function of the public answer set, requiring the calculated result of the loss function of the public answer set to be lower than the threshold, and assigns a high threshold to the loss function of the private answer set, requiring the calculated result of the loss function of the private answer set to be higher than the threshold; and an answer output module selects the final answer to the query of the original input by referring to the result of the loss function and combining it with the threshold. Attached Figure Description

[0019] The embodiments of the present invention will now be described in more detail with reference to the accompanying drawings, wherein:

[0020] Figure 1 A structural diagram of the Neural Graph Database (NGDB) is presented;

[0021] Figure 2 Example images of the query were shown, demonstrating the retrieval of answers to the privacy threat query.

[0022] Figure 3 Example diagrams of calculating the privacy threat answer set in projection, intersection, and union are shown in the embodiments of the present invention;

[0023] Figure 4 Table 1 is provided, which offers a comprehensive comparison.

[0024] Figure 5 The diagrams show eight common query types;

[0025] Figure 6 Table 2 is provided, which offers a comprehensive comparison.

[0026] Figure 7 Table 3 is provided, which offers a comprehensive comparison.

[0027] Figure 8 Table 4 is provided, which offers a comprehensive comparison.

[0028] Figure 9 A schematic diagram showing the GQE evaluation results under different privacy coefficients β is presented; and

[0029] Figure 10 A schematic diagram of the architecture of the privacy-preserving neural graph database (P-NGDB) system according to an embodiment of the present invention is shown. Detailed Implementation

[0030] In the following description, systems and methods such as privacy-preserving neural graph databases (P-NGDB) will be used as preferred examples. Those skilled in the art will understand that modifications, including additions and / or substitutions, can be made without departing from the scope and spirit of the invention. Specific details may be omitted so as not to obscure the invention; however, this disclosure is prepared to enable those skilled in the art to practice the teachings herein without undue experimentation.

[0031] This invention provides a system using P-NGDB to mitigate the risk of privacy breaches in neural graph databases (NGDBs) by protecting privacy within a graph embedding environment. Furthermore, adversarial training techniques are introduced during the training phase to force NGDB to generate indistinguishable answers when querying with privacy information, thereby increasing the difficulty of inferring sensitive information from combinations of multiple harmless queries. Extensive experimental results on three datasets demonstrate that P-NGDB can effectively protect privacy information in graph databases.

[0032] In this regard, there are several studies / works related to complex query answering (CQA) and graph privacy, as described below.

[0033] Technical Background - Complex Query Answers

[0034] A fundamental function of neural graph databases is to answer complex structured logic queries (CQA) based on data stored in NGDB. Query embedding is a common method for answering complex queries because it demonstrates effectiveness and efficiency.

[0035] These query embedding methods utilize different structures to represent complex logical queries and effectively model queries across a wide range. Several methods encode query inputs into different geometric computational representations: the GQE model encodes query inputs as vectors in the embedding space, Query2box encodes them as hyperrectangular embeddings, and HypeE encodes them as hyperbolic embeddings to support separable logical operators. Query2Particle and ConE use multiple vector embeddings and cone embeddings, respectively, to support negation operators. Research has also proposed NRNs for encoding numerical values. Furthermore, some methods use probabilistic structures to encode logical queries: BetaE, Gamma, and PERM propose using Beta, Gamma, and Gaussian distributions, respectively, to encode logical knowledge graph queries. Simultaneously, neural structures are used to encode complex queries: BiQE, SQE, and QE-GNN utilize transformers, sequential encoders, and message-passing graph neural networks, respectively. Query decomposition procedures propose decomposing complex queries, while LMPNN suggests using single-hop message passing on the query graph for CQA.

[0036] While complex query-response techniques have been extensively studied in past research, privacy issues in NGDB have been largely overlooked. With the increasing expressive power of NGDB, privacy breaches have become increasingly important. Some studies have shown that graph representation learning is vulnerable to various privacy attacks. Others have demonstrated that human inference attacks can be applied to identify the content of training sample sources. Model extraction attacks and link-stealing attacks attempt to infer information about the graph representation model and the links in the original graph, respectively. However, these works assume that attackers have complete access to the graph representation model. In NGDB, however, sensitive information can be leaked during the query phase, posing different privacy challenges. This invention reveals the privacy breach problem in NGDB and proposes a benchmark for comprehensive evaluation.

[0037] Technical Background - Graphical Privacy

[0038] To protect privacy in graph representation models, various privacy-preserving methods have been proposed. Anonymization techniques can be applied to graphs to reduce the probability of privacy leaks involving individuals and links. Graph summarization techniques aim to publish a set of anonymized graphs with privacy information removed. With the development of graph representation learning, learning-based methods have also been proposed, treating graph representation learning as a combination of two sub-tasks: main objective learning and privacy preservation, using adversarial training to remove sensitive information while maintaining the performance of the original task. Simultaneously, some methods separate sensitive information from the main learning objective. Furthermore, differential privacy introduces noise into the representation model and provides privacy guarantees for individual data points in the dataset. While the noise introduced by differential privacy can protect the model from privacy leaks, it can also significantly impact the performance of the original task. Federated learning utilizes differential privacy and encryption to prevent the transmission of participants' original data and is widely used in distributed graph representation learning. However, federated learning cannot be used to protect the inherent privacy information in the representation model.

[0039] While various graph privacy protection methods exist, they primarily focus on simple node-level or edge-level privacy protection. However, the privacy risks associated with neural graph databases in complex query-answering tasks have not been adequately addressed. In NGDB, the development of CQA models has introduced additional privacy leakage risks, allowing attackers to infer sensitive information through multiple combined queries. The P-NGDB proposed in this invention can effectively reduce the privacy leakage risk from malicious queries.

[0040] The following describes the initial problem and related issues that would help to formalize the problem.

[0041] This discussion focuses on privacy issues in multi-relational knowledge graphs with numerical attributes. Knowledge graph representations can be... in This represents the set of vertices corresponding to entities in a knowledge graph. Let r represent a relation set, where r ∈ R and is a binary function, defined as follows: This is used to describe the relationships between entities in a knowledge graph. Here, r(u,v) = 1 indicates that there is a relationship r between entities u and v; otherwise, r(u,v) = 0. The attribute set can be divided into privacy attributes and public attributes: in It is a bivariate function, defined as follows: →{0,1} is used to describe the numerical attributes of an entity, where a(u,x)=1 indicates that entity u has attribute a, and its value is Otherwise, a(u,x) = 0. In addition, there are also uses... To represent the relationships between numerical values. To prevent privacy leaks, entities... The privacy attributes of an object must not be exposed and should be protected to prevent inference.

[0042] Complex queries are a key task for NGDB, which can be defined in the first-order logical form of adoption regularization, using existential quantifiers. It consists of various types of logical expressions, such as logical conjunction (∧) and disjunction (∨). In a logical expression, each logical query has a unique variable V. ？ To represent the query target. Variables V1, ..., V k And numerical variables X1,…,X l This indicates the presence of quantified entities in complex queries. Additionally, the anchor entity V... a Sum X a The query contains specific content. Complex queries aim to identify the target entity V. ？ This allows the existence of knowledge graphs that can satisfy a given logical expression. and Complex query expressions can be represented using disjunctive normal form (DNF) as follows:

[0043] q[V ？ ] = V ？ V1, ..., V k X1, ..., X l :c1∨c2∨...∨c n c i =e i,1 ∧e i,2 ∧...∧e i,m

[0044] Atomic logic expression e i,j It can be used to represent: r(V,V′), which represents the relationship r between entities r and V′; a(V,X), which represents attribute a of entity V, whose value is X; or, f(X,X′), which represents the relationship between numerical attributes. i Represents several atomic logical expressions e i,j The associative terms. The symbols V, V′, X can be anchor entities, values, quantized variables, or numerical variables.

[0045] Regarding the formulation of the problem, let's first assume the existence of a graph. Some attributes of an entity are considered private information. in Indicates if a p If (u,x) = 1, then entity u has the sensitive attribute a. pIts value is x. Due to different privacy requirements, different entities handle attributes differently. NGDB stores the graph in the embedding space and can be queried using arbitrarily complex logical queries. Due to NGDB's generalization capabilities, attackers can easily infer sensitive attributes using complex queries. To protect privacy, NGDB should retrieve ambiguous answers for queries that pose privacy risks, while maintaining high accuracy when querying publicly available information.

[0046] This invention provides a harmless and privacy-preserving query procedure. Because neural graph databases contain sensitive information, attackers can exploit certain complex queries to infer privacy; these queries are defined as "harmless but privacy-involving (IP) queries." Even if some answers to these queries can only be inferred when privacy-involving information is involved, this still poses a privacy risk and therefore should not be retrieved from NGDB. To meet this requirement, the program architecture and mechanism for handling harmless but privacy-preserving queries are described below.

[0047] In the following description, "query" / "query q" refers to the content entered by the user into the proposed system, which may consist of a structured query language / statement. The entered query serves as a retrieval request for specific information or data in the neural graph database and is processed through various components to determine the most relevant answer while ensuring privacy protection.

[0048] The system architecture consists of two parts: "computation graph (computation map)" and "privacy-threatening query answers".

[0049] Computational graph (computational atlas):

[0050] Query q can be resolved into a computation graph (computational map), which is a directed acyclic graph (DAG) composed of various types of directed edges. These directed edges represent operators on entities and attribute sets. Operations / operators in the computation graph include projection, intersection, and union.

[0051] (1) Projection: There are various types of projection. Given a set of entities S and the relationships between the entities... Attribute type a, value set Projection calculations can describe the entities or values ​​that can be realized under specified relations and attribute types. For example, attribute projection is represented as P_a(S)={x∈N|v∈S,a(v,x)=1}, which describes the values ​​that any entity in S can realize under attribute type a. Furthermore, relation projection P is also proposed. r (S) Inverse attribute projection sum of numerical projections P f (S), and all these projections are represented as P(S).

[0052] (2) Intersection: Given a set of entities or value sets S1, S2, ..., S n Use this logical operator to calculate the intersection of these sets, i.e.

[0053] (3) Union: Given a set of entities or values ​​S1, S2, ..., S n Use this operator to calculate the union of these sets, i.e. of.

[0054] Answer to the privacy threat query:

[0055] After a complex query is parsed into a computational graph G, M = G(S) can represent the set of answers, including entities or values ​​retrieved by the computational graph. Therefore, based on whether the answer requires the involvement of privacy information, the M retrieved from the complex query can be divided into privacy-preserving answer sets Ms. private Non-privacy answer set M public .

[0056] Figure 2 An example query is provided, showing the results of a privacy threat search. Figure 2 In the diagram, node N represents privacy risks. Figure 2 In Part (A), logical knowledge graph queries involve privacy information. Figure 2 In Part (B), there is an example of a complex query in the knowledge graph where Toronto is considered a privacy threat answer because it must be inferred from sensitive information.

[0057] Figure 2 In Part (A), the listed queries retrieve answers from a knowledge graph, and Toronto is considered an answer that poses a privacy threat because...

[0058] Projection operation / operator: If the projection operation is used to infer privacy attributes, the output of the projection operator will be considered privacy-sensitive. Assume M = P(S) and the input S = S... private ∪S public ; P(S) = P(S) private )∪P(S public Without loss of generality, the projection privacy answer set M can be defined for both cases. private We will discuss the formal definition of [the term].

[0059] For the projection onto the public input, it is:

[0060] For projection on privacy input, it is: M private =P(S)Private ).

[0061] Figure 3 An example diagram illustrating the calculation of the privacy threat answer set using projection, intersection, and union according to an embodiment of the present invention is provided. In the diagram, node N1 represents a non-privacy answer, node N2 represents a privacy threat answer, and node N3 represents different privacy risks within a subset. Dashed arrows A1, A2, and A3 represent privacy projections. The areas delineated by dashed lines D1, D2, D3, and D4 represent the privacy threat answer set. Figure 3 As shown in part (A), all nodes N2 in the answer set can be individually derived from the privacy attribute links and are classified as query answers with privacy risks. On the other hand, although all nodes N3 can be accessed through privacy projection, they can also be inferred from public components, thus having lower privacy risks.

[0062] Intersection operator: The output of the intersection operator is considered to involve privacy if the answer belongs to any set of private answers. Given a set of answers M 1 M 2 ,…,M n Each answer set After the intersection operator like Figure 3 As shown in section (B), node N3 is classified as a privacy threat answer because its representation involves existing elements within a subset of answers.

[0063] Union operation / operator: If the answer is an element that belongs to the private answer set of the computational subgraph but not to the public answer set, the output of the union operator will be considered privacy-sensitive. Given a set of answers like Figure 3 As shown in section (C), all nodes N2 in the answer set can only be inferred from privacy attribute links and are classified as privacy threat answers.

[0064] Next, a privacy-preserving neural graph database according to embodiments of the present invention is provided. The privacy-preserving neural graph database is used to protect sensitive information in a knowledge graph while maintaining high-quality performance in answering complex queries. Here, two optimization objectives are set for P-NGDB: maintaining the accuracy of retrieving non-privacy answers and obfuscating answers that threaten privacy.

[0065] Encoded representation of privacy-preserving neural graph databases:

[0066] The query encoding method used encodes the query into the embedding space and compares it with the similarity of entities or attributes to retrieve the answer. The encoding process can be represented as follows:

[0067] q = f(Query),

[0068] Where f g It is through θ g A parameterized query encoding method is used, q∈R d The query embedding is used to simplify the representation. Given a query, the query is iteratively computed based on the subquery embedding and logical operators. Assume that during the encoding process in step i, the subquery embedding is q. i The logical operators projection, intersection, and union can then be represented as:

[0069]

[0070]

[0071]

[0072] Where f p f i and f u These represent the projection, intersection, and union operators used for parameterization, respectively. After query encoding, a score for each candidate can be calculated based on the query code and entity (attribute) embeddings. Finally, the normalized probability can be calculated using the Softmax function, as shown below:

[0073]

[0074] Where s is the scoring function, such as similarity, distance, etc. It is a candidate set.

[0075] Learning objectives of privacy-preserving neural graph databases:

[0076] In a privacy-preserving neural graph database, there are two learning objectives: given a query, P-NGDB should accurately retrieve non-privacy answers and obfuscate privacy answers. For public retrievals, given the query embedding q, the loss function can be expressed as:

[0077]

[0078] Where N is the open set of answers to the given query.

[0079] Regarding privacy protection, the learning objective is the opposite. The objective is not to retrieve the correct answer, but to provide a confusing answer to address privacy concerns. Therefore, for a privacy-preserving answer, given the query embedding q, the objective can be represented as:

[0080]

[0081] in It is the set of privacy risk answers for a given query.

[0082] In one embodiment, a query can be decomposed into subqueries and logical operators. For intersection and union, logical operators do not generate new privacy-infringing answers; while for projection, if the projection involves privacy-sensitive information, the answer can be privacy-sensitive. Therefore, the projection operator can be directly optimized to protect sensitive information. The privacy-preserving learning objective can be expressed as:

[0083]

[0084] The solution provided by this invention aims to achieve both of these objectives simultaneously, and the final learning objective function can be expressed as:

[0085] L = L u +βL p ,

[0086] β is a privacy coefficient that controls the protection strength in P-NGDB; the larger β is, the stronger the protection.

[0087] Experiments demonstrated the system's performance against P-NGDB. To evaluate the privacy leakage issues in NGDB and the protection capabilities of the proposed P-NGDB, a benchmark was constructed on three real-world datasets, and the performance of P-NGDB was evaluated based on this benchmark.

[0088] Experiment - Dataset

[0089] The benchmark tests were created based on a numerical complex query dataset, which was built on three publicly available knowledge graph datasets: FB15K-numerical, DB15K-numerical, and YAGO15K-numerica. In each knowledge graph, vertices describe entities and attributes, while edges describe entity relationships, entity attributes, and numerical relationships.

[0090] First, a set of edges representing entity attributes is randomly selected as privacy information. Then, the remaining edges are divided in an 8:1:1 ratio to construct training, validation, and test edge sets respectively. The training graph G_train, validation graph G_val, and test graph G_test are constructed on the training edges, training + validation edges, and training + validation + test edges, respectively. Detailed statistical information for the three knowledge graphs is as follows: Figure 4 As shown in Table 1, "#Nodes" represents the number of entities and attributes, "#Edges" represents the number of relation triples and attribute triples, and "#Pri.Edges" represents the number of attribute triples considered to be private.

[0091] Experimental-Benchmark Building

[0092] like Figure 5 As shown, it evaluates the response performance of complex queries on the following eight general query types, abbreviated as 1p, 2p, 2i, 3i, ip, ip, 2u, and up.

[0093] Figure 5 Eight general query types are presented. These arrows represent projection, intersection, and union operators, respectively. For each general query type, each edge represents a projection or logical operator, and each node represents a set of entities or values. A sampling method is used to randomly sample complex queries from the knowledge graph. Training, validation, and test queries are randomly sampled from the previously constructed graph. For training queries, corresponding training answers can be searched on the training graph. For validation queries, generalization ability is evaluated using queries on the validation graph that differ from the answers on the training graph. For test queries, a graph search is performed on the test graph with private edges to identify test answers, and the answers are categorized into privacy and public sets based on the privacy risk query answer definition discussed earlier. Statistical analysis is performed on the number of privacy risk answers for different types of complex queries in the three knowledge graphs; the statistical data is as follows: Figure 6 As shown in Table 2.

[0094] Experiment - Experiment Configuration

[0095] For the established benchmark, the proposed P-NGDB can be applied to various complex query encoding methods to provide privacy protection.

[0096] Three commonly used complex query encoding methods can be selected to compare the performance of using P-NGDB and not using P-NGDB for protection.

[0097] • GQE: The Graphical Query Encoder model encodes complex queries into vectors embedded in a space.

[0098] •Q2B: The graph query encoder model encodes complex queries into a superrectangular embedding space.

[0099] • Q2P: The graph query encoder model encodes complex queries into an embedding space with multiple vectors.

[0100] This assumes that no privacy protection methods are used in NGDB. Therefore, these methods are compared based on noise perturbation, similar to differential privacy, a common technique in database queries that introduces randomness into the answer by adding noise.

[0101] Regarding the evaluation metrics, the evaluation consists of two distinct parts: inference performance evaluation and privacy protection evaluation. In performance evaluation, the generalization ability of the model is assessed by calculating the ranking of answers that cannot be observed from the knowledge graph but can be directly retrieved. Given a test query q, the training, validation, and public test answers are represented as Mtrain, Mval, and Mtest, respectively. Then, the quality of the retrieved answers is evaluated using the hit ratio (HR) and mean reciprocal rank (MRR). The HR@K metric assesses the accuracy of retrieval by measuring the percentage of correct hits among the top K retrieved items. The MRR metric assesses the performance of the ranking model by calculating the mean reciprocal rank of the first relevant item in the ranked list. The metrics can be defined as follows:

[0102]

[0103] Where the metric is HR@K, then m(r) = 1 [r ≤ K]; if the metric is MRR, then Here, a higher value indicates better reasoning performance.

[0104] In the privacy protection assessment, a ranking metric is calculated for answers that threaten privacy, since these answers cannot be inferred from the observed graph; the smaller the value, the stronger the protection. All models are trained using training queries and privacy attributes, and hyperparameters are tuned using validation queries. Then, the models are evaluated against test queries, including performance evaluation of public answers and privacy evaluation of private answers. Finally, the experimental results for testing public and private queries are reported separately.

[0105] Regarding parameter settings, the hyperparameters of the basic query encoding method were first adjusted on the validation query. NGDB uses the same parameters to ensure a fair comparison. For ease of illustration, the privacy penalty coefficient (β) was adjusted for each of the three datasets to achieve a balance between performance and privacy. The noise intensity was also adjusted to protect privacy from noise interference, ensuring results are comparable to NGDB and maintaining similar performance on public query answers.

[0106] For performance evaluation, P-NGDB was applied to three different query encoding methods: GQE, Q2B, and Q2P, and query response performance with and without P-NGDB protection was compared. Experimental results are summarized in... Figure 7 Table 3 and Figure 8 In Table 4.

[0107] Table 3 reports the average results for HR@3 and MRR, where higher values ​​on the public answer set indicate better reasoning ability, while lower values ​​on the private answer set indicate stronger protection. The results show that without protection, and if sensitive information exists in the knowledge graph, the underlying encoding methods suffer from privacy leakage. The proposed P-NGDB effectively protects privacy information with only a slight loss in complex query answering ability. For example, in FB15K-N, GQE without privacy protection has an HR@3 of 21.99 for public answers and 28.99 for private answers; while with P-NGDB protection, GQE's HR@3 for public answers is 15.92 and for private answers is 10.77. With privacy protection, HR@3 decreases by 62.9%, and HR@3 for public answers decreases by 27.4%. Compared to noise-based protection, the proposed method can accurately protect sensitive information with significantly lower performance loss than noise-based protection.

[0108] Table 4 presents the MRR results of P-NGDB for various query types. The percentages in parentheses represent the performance of the P-NGDB-protected model relative to the unprotected coded model. Evaluations were performed separately for public and private answers to assess privacy protection. The comparison of MRR changes for public and private answers shows that P-NGDB provides protection for all query types. Furthermore, comparing the average changes across these query types clearly demonstrates that P-NGDB exhibits varying degrees of protection for different query types. For projection and union operations, the protected model shows a significantly lower MRR for private answers, indicating stronger protection. For the intersection operator, the preservation provided by P-NGDB is as effective as the protection for other operators.

[0109] Regarding sensitivity studies, privacy protection requirements may vary across different knowledge graphs. The impact of the privacy penalty coefficient β was evaluated, where a larger β indicates stronger privacy protection. β values ​​were selected from {0.01, 0.05, 0.1, 0.5, 1}, and the retrieval accuracy for both public and private answers was evaluated separately. The retrieval performance of GQE on the FB15K-N dataset was evaluated, and the change in MRR under various β values ​​compared to the unprotected GQE model is shown below. Figure 9 As shown, the evaluation results of GQE with different privacy coefficients β on FB15K-N are presented. The results show that the penalty mechanism can effectively control the level of privacy protection, and P-NGDB must accept a greater utility loss to meet higher privacy requirements. In addition, because the privacy coefficient can be flexibly adjusted, P-NGDB can adapt to various scenarios with different privacy requirements.

[0110] The proposed system can be physically installed in hardware devices. Figure 10A schematic diagram of the architecture of a system 100 using P-NGDB according to an embodiment of the present invention is shown.

[0111] System 100 can be used as a privacy-preserving neural graph database (i.e., P-NGDB) to receive queries from users, and then the privacy-preserving neural graph database responds to the input query and provides an answer to the user. System 100 includes a user query input receiver 110, a graph builder module 120, a query encoder model 130, an answer retrieval module 140, a privacy risk identifier 150, a score calculation engine 160, and an answer output module 170.

[0112] User query input receiver 110 can act as a user interface. For example, through user query input receiver 110, a user can input a query into system 100, and the query can be in the form of a question in natural language or a structured query language.

[0113] User query input receiver 110 forwards input queries to graph builder module 120. Graph builder module 120 is responsible for constructing computational graphs, converting input queries into directed acyclic graphs, where edges represent operations on entities and attribute sets.

[0114] Query encoder model 130 receives the computed query graph from graph builder module 120, and then processes the computed query graph. Query encoder model 130 is configured to convert the query graph (i.e., the computed query graph) into a vector format that can be processed by the components of system 100 (i.e., it is readable by the components of system 100). Through the encoding process provided by query encoder model 130, the input query is converted into a vector representation (e.g., converting the input query into a numerical representation).

[0115] The answer retrieval module 140 receives a vector / numerical representation of the query from the query encoder model 130; for ease of description, the received information at this stage is referred to as the query vector. The answer retrieval module 140 further uses the query vector processed by the query encoder model 130 to retrieve a set of candidate answers. In one embodiment, the system 100 also includes an embedding transformer module configured to encode the query vector into an embedding space. The processing result of the embedding transformer module may be an optimized query vector. In one embodiment, the answer retrieval module 140 includes a projection engine 142 for computing a query graph and an operator setting model 144.

[0116] In the computational graph, the projection engine 142 can perform various types of projection operations, such as attribute projection and relation projection. The process performed by the projection engine 142 involves extracting relevant entities or values ​​from the entity set and processing them according to the specified relations and attribute types.

[0117] In answer retrieval, operator setting model 144 is responsible for handling set operations, such as intersection and union. Operator setting model 144 performs set operations on multiple sets of entities or values ​​to obtain a result set. For example, operator setting model 144 can provide intersection operations / operators on multiple sets of entities or values ​​to identify common elements shared across all sets; and operator setting model 144 can provide union operations / operators on multiple sets of entities or values ​​to identify all elements in all sets.

[0118] After passing through the Richard query vector in the answer retrieval module 140, the information output by the answer retrieval module 140 can represent the answer set of entities or values ​​retrieved from the computational graph.

[0119] The answer set can be passed to a privacy risk identifier 150. The privacy risk identifier 150 is configured to determine whether the answer set poses any privacy risk, examine sensitive information, and flag queries that may lead to privacy breaches. In one embodiment, the privacy risk identifier 150 includes a privacy threat answer classification model 152, which collaboratively classifies answer sets from a computational graph into public answer sets (i.e., non-privacy answer sets) and privacy answer sets, based on whether the answer set requires inference in cases involving privacy information.

[0120] The privacy answer set consists of answers from which privacy information needs to be derived, while the public answer set (i.e., the non-privacy answer set) does not contain such information. When the projection operation result provided by the projection engine 142 involves privacy attributes, the privacy risk identifier 150 uses the privacy threat answer classification model 152 to mark the obtained answer as a privacy answer. Similarly, if the result of the intersection operation provided by the operator setting model 144 belongs to the privacy answer set, then even if it is derived from multiple answer sets, the privacy risk identifier 150 will still use the privacy threat answer classification model 152 to regard the result of the intersection operation as a privacy answer. For the result of the union operation provided by the operator setting model 144, if the result includes elements that belong to the privacy answer set but not to the public answer set, it is considered a privacy answer.

[0121] In one embodiment, the privacy risk identifier 150 includes a privacy evaluator model 154 configured to evaluate whether the privacy answer set contains any privacy answers with low privacy risk. Specifically, in the privacy answer set, an answer is determined to have low privacy risk if it is accessible via privacy projection but can also be inferred from public components using intersection or union operators / operations.

[0122] The public answer set (i.e., the non-private answer set) and the private answer set are then fed from the privacy risk identifier 150 to the score calculator engine 160. The score calculator engine 160 is configured to calculate the score for each candidate answer by using a corresponding loss function to compute the probability of the result set. In one embodiment, the computational objectives are reversed in the private and non-private answer sets.

[0123] The loss function for the public answer set (i.e., the non-private answer set) uses the public answer set of the given query as a calculation factor / parameter. The goal of public retrieval is to ensure that System 100 can accurately retrieve public / non-private answers; the loss function measures the accuracy of public answer retrieval. For the private answer set, the loss function uses the privacy-risk answer set of the given query as a calculation factor / parameter. The goal of privacy protection is to obfuscate private answers to prevent the leakage of private information; therefore, a loss function is used to optimize the output information to effectively obfuscate private answers.

[0124] In one embodiment, the score calculation engine 160 can set relative thresholds for the two loss functions. For example, a low threshold can be assigned to the loss function for the public answer set (i.e., the non-private answer set), requiring the calculated result of the loss function for the public answer set to be below the threshold. Conversely, a high threshold can be assigned to the loss function for the private answer set, requiring the calculated result of the loss function for the private answer set to be above the threshold. This approach is advantageous because, under privacy-preserving conditions, it can effectively obfuscate private answers while maintaining high accuracy in querying public information.

[0125] The answer output module 170 is configured to reference the result of a loss function and consider a threshold to select the final answer. In one embodiment, the answer output module 170 may use an algorithm, AI model, or machine learning model to select the most suitable answer from processed answers that have already been privacy-protected, filtered for sensitive information, and scored. The algorithm, AI model, or machine learning model in system 100 is well-trained. In one embodiment, adversarial techniques may be introduced during the training phase of P-NGDB to generate indistinguishable or obfuscated answers when queries are made using privacy information, thereby making it more difficult to infer privacy through complex privacy queries while still accurately retrieving non-privacy answers.

[0126] Therefore, systems with P-NGDB can provide answers with different levels of precision for queries with varying privacy risks. This approach simplifies the privacy-preserving process while reducing computational power consumption. Consequently, this process accelerates computation and maximizes efficiency while maintaining strict privacy protection.

[0127] As stated above, this disclosure raises the privacy issue in neural graph databases, demonstrating that attackers can infer sensitive information through specified queries. It is important to note that some query answers may reveal private information, termed privacy-risk answers. To systematically evaluate the proposed problem, benchmark datasets were constructed based on FB15k-N, YAGO15k-N, and DB15k-N. Furthermore, a novel framework is proposed to protect the privacy of knowledge graphs from malicious queries by attackers. Experimental results built on benchmarks demonstrate that the proposed model (P-NGDB) effectively protects privacy while sacrificing only a small amount of inference performance.

[0128] The functional units and modules of the processors and methods disclosed herein can be embodied in hardware or software. That is, the claimed processor can be fully implemented as machine instructions or as a combination of machine instructions and hardware elements. Hardware elements include, but are not limited to, computing devices, computer processors, or electronic circuits, including, but not limited to, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), microcontrollers, and other programmable logic devices configured or programmed according to the teachings of this disclosure. Those skilled in the art of software or electronics can readily prepare computer instructions or software code to run in computing devices, computer processors, or programmable logic devices based on the teachings of this disclosure.

[0129] The system may include a computer storage medium, a transient and non-transient memory device storing computer instructions or software code, which can be used to program or configure a computing device, computer processor, or electronic circuit to perform any of the processes of the present invention. The storage medium, transient and non-transient memory device may include, but is not limited to, floppy disks, optical disks, Blu-ray discs, DVDs, CD-ROMs, magneto-optical disks, ROMs, RAMs, flash memory devices, or any type of medium or device suitable for storing instructions, code, and / or data.

[0130] The system can also be configured as a distributed computing environment and / or a cloud computing environment, in which all or part of the machine instructions are executed in a distributed manner by one or more processing devices interconnected by a communication network, such as an intranet, a wide area network (WAN), a local area network (LAN), the Internet, and other forms of data transmission media.

[0131] The foregoing description of the present invention is provided for illustrative purposes. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to those skilled in the art.

[0132] These embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling those skilled in the art to understand the various embodiments of the invention and the various modifications suitable for the intended particular use.

Claims

1. A system for a privacy-preserving neural graph database, used to receive queries from user input and to provide answers to the user in response to the queries, characterized in that, include: A user query input receiver is configured as a user interface to receive structured query language from a user and use it as the input query. The graph builder module receives queries from the user query input receiver and constructs a computational graph to transform the query into a directed acyclic graph, where edges represent operations on entities and attribute sets. A query encoder model is configured to receive a query graph related to the computational graph from the graph builder module for processing the query graph, wherein the query encoder model is configured to convert the query graph into a vector format; The answer retrieval module is used to receive the vector format of the query graph from the query encoder model and retrieve a set of candidate answers, wherein the information output by the answer retrieval module represents the set of answers for entities or values ​​retrieved by the computational graph; A privacy risk identifier is used to receive information output by the answer retrieval module, determine whether the answer set has privacy risks, check sensitive information, and mark queries that lead to privacy leaks. The privacy risk identifier is also used to divide the answer set in the computation graph into a public answer set and a private answer set. A score calculation engine is used to receive the public answer set and the private answer set, calculate the probability of the public answer set and the private answer set using corresponding loss functions, and calculate a score for each candidate answer. The score calculation engine assigns a low threshold to the loss function of the public answer set, requiring the calculated result of the loss function of the public answer set to be lower than the threshold, and assigns a high threshold to the loss function of the private answer set, requiring the calculated result of the loss function of the private answer set to be higher than the threshold. The answer output module is used to select the final answer to the query of the original input by referring to the result of the loss function and combining it with the threshold.

2. The system according to claim 1, characterized in that, The query encoder model is also used to provide an encoding procedure that converts the query into a vector or numerical representation.

3. The system according to claim 1, characterized in that, The answer retrieval module includes a projection engine and an operator setting model for manipulating the computational graph.

4. The system according to claim 3, characterized in that, The projection engine is used to perform various types of projection operations, including attribute projection operations and relation projection operations.

5. The system according to claim 4, characterized in that, The projection engine is used to perform various types of projection operations, including attribute projection and relation projection, which involve extracting relevant entities or values ​​from an entity set and processing them according to specified relations and attribute types.

6. The system according to claim 5, characterized in that, The operator setting model is used to handle set operations, including intersection and union operations.

7. The system according to claim 6, characterized in that, The operator setting model provides an intersection operator on multiple sets of entities or values ​​to identify common elements shared across all sets, and the operator setting model provides a union operator on multiple sets of entities or values ​​to identify all elements in all sets.

8. The system according to claim 7, characterized in that, The privacy risk identifier includes a privacy threat answer classification model, which collaboratively classifies the answer set from the computational graph into the public answer set and the privacy answer set, based on whether the answer set must involve privacy information.

9. The system according to claim 8, characterized in that, When the projection operation result provided by the projection engine involves privacy attributes, the privacy risk identifier uses the privacy threat answer classification model to mark the obtained answer as a privacy answer. Furthermore, for the intersection operation result provided by the operator setting model, if it belongs to the privacy answer set, even if the result comes from multiple answer sets, the privacy risk identifier still uses the privacy threat answer classification model to treat the result as a privacy answer. Also, for the union operation result provided by the operator setting model, if it includes elements belonging to the privacy answer set but not to the public answer set, the result is considered a privacy answer.

10. The system according to claim 8, characterized in that, The privacy risk identifier also includes a privacy evaluator model, which is used to evaluate whether the set of privacy answers contains any privacy answers with low privacy risk.

11. The system according to claim 1, characterized in that, The answer output module is used to select the most suitable answer from the answer set using algorithms, artificial intelligence models, or machine learning models.

12. The system of claim 11, wherein the algorithm, the artificial intelligence model, or the machine learning model has been trained and adversarial techniques have been introduced during its training phase to generate indistinguishable or obfuscated answers when using privacy information queries, thereby making it more difficult to infer privacy through complex privacy queries, while still being able to accurately retrieve non-privacy answers.

13. A method for a privacy-preserving neural graph database, for receiving queries from user input and providing answers to the user in response to the queries, characterized in that, include: The system receives structured query language input from users through a user query input receiver and uses it as a query. The graph builder module constructs a computational graph to transform the query into a directed acyclic graph, where edges represent operations on entities and attribute sets. By querying the encoder model, the query graph related to the computational graph is encoded into a vector format; The answer retrieval module retrieves the vector format of the query graph into a candidate answer set, wherein the information output by the answer retrieval module represents the answer set of entities or values ​​retrieved by the computational graph; The privacy risk identifier determines whether the answer set has any privacy risks, checks sensitive information, and marks queries that lead to privacy breaches. The privacy risk identifier categorizes the answer set from the computation graph into a public answer set and a private answer set. The scoring engine calculates the probabilities of the public answer set and the private answer set using the corresponding loss function, and calculates the score for each candidate answer. The scoring engine assigns a low threshold to the loss function of the public answer set, requiring the calculated result of the loss function of the public answer set to be lower than the threshold, and assigns a high threshold to the loss function of the private answer set, requiring the calculated result of the loss function of the private answer set to be higher than the threshold. as well as The final answer to the query from the original input is selected by referring to the result of the loss function and combining it with the threshold through the answer output module.

14. The method according to claim 13, characterized in that, The answer output module is used to select the most suitable answer from the answer set using algorithms, artificial intelligence models, or machine learning models.

15. The method according to claim 14, characterized in that, The algorithm, the artificial intelligence model, or the machine learning model has been trained and adversarial techniques have been introduced during its training phase to generate difficult-to-distinguish or obfuscated answers when using privacy information queries, thereby making it more difficult to infer privacy through complex privacy queries, while still being able to accurately retrieve non-privacy answers.

Images