An attribute-based PPR and self-loop weight adjustment-based graph neural network defense method

Abstract

The application belongs to the field of artificial intelligence, and particularly relates to a graph neural network anti-attack and defense method based on attribute enhancement PPR and self-loop weight adjustment, which comprises the following steps: nodes are stopped at the current node or walk to the neighbor node with a certain probability, the topology migration or attribute migration is performed with a certain probability during the walking, the similarity between nodes is calculated by considering the topology and attribute features of multi-hop high-order information, the nodes with insufficient similarity are cut off by using the similarity score, and the corresponding edge weight value is given based on the similarity score between the nodes to reconstruct the adjacency matrix; in the message aggregation process, the proportion of the target node in the final message is dynamically adjusted based on the out-degree of the target node, so that the proportion of the neighbor node is large when the node has more neighbors, and the proportion of the node itself is large when the node has fewer neighbors; message propagation is performed through the reconstructed adjacency matrix; a robust graph neural network with anti-attack and defense capability is trained through iterative message aggregation and propagation; and the robustness of the graph neural network is improved.

Description

Technical Field

[0001] This invention belongs to the fields of artificial intelligence, natural language processing, and affective computing, and specifically relates to a graph neural network adversarial defense method based on attribute augmentation principle (PPR) and self-loop weight adjustment. Background Technology

[0002] Generative Neural Networks (GNNs), due to their powerful learning capabilities, have been widely applied in various fields such as recommender systems, community search, and data analysis. However, GNNs are vulnerable to adversarial attacks during training. Attackers can modify the edges and nodes of the graph in the training dataset within a certain perturbation range, interfering with the GNN's training, leading to decreased model performance and prediction errors during inference. Therefore, many existing studies have proposed adversarial defense methods for GNNs. For example, GNNGuard mainly utilizes graph topological information to adjust node weights to enhance the robustness of GNNs. RGCN uses a Gaussian distribution to represent the feature vectors of nodes and employs an attention mechanism based on the variance of node features to control node weights, thus defending against adversarial attacks.

[0003] While existing methods have achieved some success in adversarial defense, they still face two major limitations. First, the edge weight allocation is not reasonable enough. According to the message passing mechanism of GNNs, edge weights directly affect the node and graph vector representations, determining the accuracy of the GNN model. Furthermore, some defense methods prune abnormal edges based on edge weights. Existing methods only consider either graph structure or node attributes, without comprehensively considering both, leading to insufficient accuracy in node similarity measurement and representation learning. Second, the influence of perturbation nodes is not sufficiently reduced. GNNs primarily learn node representations by aggregating features from themselves and their neighbors. However, the number and overall features of neighboring nodes are always greater than those of the target node, causing neighboring node features to account for a significant proportion of the target node's representation. Graph adversarial attacks always attack by modifying neighboring nodes; over-reliance on neighbors makes GNNs more vulnerable to adversarial perturbations. Therefore, reducing the influence of compromised nodes in representation learning is crucial. Summary of the Invention

[0004] To address the issue that existing methods focus solely on graph topology or node attributes, neglecting to comprehensively consider evaluating the importance of neighboring nodes based on both information to mitigate the impact of unimportant or compromised nodes on GNN representation learning, this invention proposes a graph neural network adversarial defense method based on Attribute Augmentation Relationship (PPR) and self-loop weight adjustment. Applied to link prediction tasks in graph data, this method utilizes a defense-optimized graph neural network model to predict potential links in graph data, determining whether a link exists between two nodes, thus improving prediction accuracy under adversarial attacks. Nodes can be user nodes; for example, predicting a link between two users allows recommending other users to the user node in a social network. Nodes can also be other entity nodes, such as users or products; if a link exists between a user node and a product node, a shopping website can recommend product nodes that may have a link to the user node. This invention can maintain the accuracy of link prediction even when nodes are modified. The invention specifically includes the following steps:

[0005] A node has a certain probability of stopping at the current node or roaming to a neighboring node. When roaming, it has a certain probability of performing topology migration or attribute migration. The similarity between nodes is calculated by considering the topology and attribute features of multi-hop higher-order information.

[0006] The adjacency matrix is ​​reconstructed by pruning nodes with insufficient similarity based on the similarity scores between nodes and assigning corresponding edge weight values ​​based on the similarity scores between nodes.

[0007] During message aggregation, the weight of the node itself and its neighboring nodes in the final message is dynamically adjusted based on the out-degree of the target node, so that the neighboring nodes have a larger weight when there are many neighbors, and the node itself has a larger weight when there are few neighbors.

[0008] Message propagation is performed using the reconstructed adjacency matrix, loss is calculated based on the model output, and the model is optimized through backpropagation. Through iterative message aggregation and propagation, a robust graph neural network with adversarial defense capabilities is trained.

[0009] Furthermore, when performing a random walk in graph data, starting from a given starting node v i At the start, the random walk stops at the current node with probability α; selects the next node with probability 1-α, and selects the next node of the walk with probability β based on attribute probability, and selects the next node of the walk with probability 1-β based on topological probability.

[0010] Furthermore, the attribute probability P a [v j ,v l Based on node v j and v l Shared attribute calculations are represented as:

[0011]

[0012] Among them, P a [v l ,v j ] represents node v j Walk to node v based on attribute probability l The probability of X[v] l ] represents node v l The eigenvectors; V represents the set of all nodes in the graph.

[0013] Furthermore, the topology migration probability is calculated based on the degree of the node, that is, it is set as the reciprocal of the node's out-degree.

[0014] Furthermore, the edge weights in the reconstructed adjacency matrix are expressed as follows:

[0015]

[0016] Among them, S (l) [v i ,v j ] represents node v i With node v j In the similarity value of the l-th layer of the graph neural network, T is a set edge weight threshold; A l [v i ,v j To reconstruct the adjacency matrix of node v in the l-th layer of a graph neural network i With node v j Edge weights; Π[v i ,v j ] represents node v j Relative to node v i Attribute enhancement PPR; X (l) [v i ] represents node v i The feature vector of the l-th layer; X (l) [v j ] T Represents node v i The feature vector X in the l-th layer (l) [v j The transpose of ]; ||·||2 represents the l2 normal form.

[0017] Furthermore, in a graph data, node v j Relative to node v i Attribute enhancement PPRΠ[v i ,v j ] is represented as:

[0018]

[0019] in, For the wanderer from node v i After starting, the node v is reached after k jumps. j The probability of this is denoted as P. T [v i ,v j ]=(1-β)P t [v i ,v j ]+βP a [v i ,v j ], where β is the probability of the walk type, that is, the probability that the walker will move according to node v with probability β. i With node v j The probability P of the attributes between a [v i ,v j Perform a walk, with a probability of (1-β) based on node v i With node v j The topological transition probability P between t [v j ,v l The process involves walking around; α is the stopping probability.

[0020] Furthermore, during message aggregation, the weight of the node itself and its neighboring nodes in the final message is dynamically adjusted based on the out-degree of the target node, i.e.:

[0021]

[0022] in, After weighting the self-loop weights, the node v in the reconstructed adjacency matrix of the l-th layer of the graph neural network is... i and v j edge weights; γ i For node v i The self-loop weights of the current node decrease as the number of neighboring nodes increases and decrease as the number of neighboring nodes decreases; I represents the identity matrix.

[0023] Furthermore, the self-loop weight is inversely proportional to the out-degree of the node.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] 1. A graph neural network adversarial defense model based on attribute augmentation (PPR) and self-loop weight adjustment is proposed. This model considers both node attributes and topological information to calculate edge weights and the final node representation, thereby improving the robustness of the graph neural network.

[0026] 2. This invention proposes an attribute-enhanced personalized PageRank that considers both node attributes and topology to measure the similarity between nodes as the weight of nodes. A significant feature of this method is that it fully considers the multidimensional information of nodes, thereby making the connections (edges) between node pairs more important (weights). Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] This invention proposes a graph neural network adversarial defense method based on attribute enhancement principle (PPR) and self-loop weight adjustment, and applies it to link prediction tasks. The practical effectiveness of the method is verified by evaluating the model's prediction performance under attack conditions. Specifically, it includes the following steps:

[0030] A node has a certain probability of stopping at the current node or roaming to a neighboring node. When roaming, it has a certain probability of performing topology migration or attribute migration. The similarity between nodes is calculated by considering the topology and attribute features of multi-hop higher-order information.

[0031] The adjacency matrix is ​​reconstructed by pruning nodes with insufficient similarity based on the similarity scores between nodes and assigning corresponding edge weight values ​​based on the similarity scores between nodes.

[0032] During message aggregation, the weight of the node itself and its neighboring nodes in the final message is dynamically adjusted based on the out-degree of the target node, so that the neighboring nodes have a larger weight when there are many neighbors, and the node itself has a larger weight when there are few neighbors.

[0033] Message propagation is performed using the reconstructed adjacency matrix, loss is calculated based on the model output, and the model is optimized through backpropagation. Through iterative message aggregation and propagation, a robust graph neural network with adversarial defense capabilities is trained.

[0034] The present invention enables link prediction, which determines whether a link exists between two nodes in a graph network. For example, in a social network, each user is considered a node in the graph network, and relationships such as likes, shares, and comments between nodes are considered edge relationships. By predicting whether a link might exist between two nodes in the constructed social network, recommendations can be made to users who may have an edge relationship. In addition, in shopping websites, entities such as products, users, and stores can be considered as nodes. Through link prediction, products or stores that may have a link relationship with a user node can be recommended, thereby improving the effectiveness of promotional activities.

[0035] In this embodiment, given a graph G(V,E,X), where V and E are sets of n nodes and m edges respectively, and X∈R n×k The table contains an attribute matrix with k node attributes. X[v] i ,r j ] = w i,j Represents node v i Has attribute r j And the weight of this attribute is w. i,j The attacker increases the number of edges (denoted as) E. a , edge deletion (E d And modifying node attributes to generate attack samples G'(V,(E\E) d )∪E a The change of G' relative to the original graph G is not easily noticeable but can lead to model recognition errors.

[0036] To alleviate the above problems, this embodiment proposes a graph neural network adversarial defense method based on attribute enhancement principle (PPR) and self-loop weight adjustment, including the following steps:

[0037] Step 1: A node stops at the current node or moves to a neighboring node with a certain probability. During the move, a topology migration or attribute migration is performed with a certain probability. The similarity between nodes is calculated by considering the topology and attribute features of multi-hop higher-order information.

[0038] Step 2: Use similarity scores to remove nodes with insufficient similarity and reconstruct the adjacency matrix, and assign corresponding edge weights based on the similarity scores between nodes.

[0039] Step 3: During message aggregation, dynamically adjust the weight of the node itself and its neighboring nodes in the final message based on the out-degree of the target node, so that the neighboring nodes have a larger weight when there are many neighbors, and the node itself has a larger weight when there are few neighbors.

[0040] Step 4: Propagate messages using the reconstructed adjacency matrix, calculate the loss based on the model output, and backpropagate to optimize the model. Through iterative message aggregation and propagation, a robust GNN model with adversarial defense capabilities is trained.

[0041] In step 1, intuitively, there are two nodes. and High similarity is defined by satisfying any of the following characteristics:

[0042] 1) There are many high-probability paths from arrive This can be determined by setting two thresholds. First, set a probability threshold to obtain the values ​​from the nodes. To the node The number of paths exceeding this threshold is then determined. A threshold is set, and the system checks if the number of paths exceeds this threshold. If it does, the node... With nodes Highly similar;

[0043] 2) and There are many common direct or indirect attributes. That is, the similarity between two nodes can be calculated. When the similarity between the attributes of two nodes is greater than a set threshold, the two nodes are judged to be highly similar.

[0044] Based on this, this embodiment proposes an attribute-enhanced random walk that simultaneously considers node topology and attribute information. Given a graph G(V,E,X), the attribute-enhanced random walk is mainly controlled by two parameters: the stopping probability α and the attribute branch probability β. Starting from a given initial node v... i Initially, the random walk proceeds as follows:

[0045] 1.1 With probability α, the walker stops at the current node;

[0046] 1.2 With probability 1-α, the walker moves to another node v according to the following rules. l :

[0047] 1.2.1 With probability β, the wanderer has attribute probability P a [v j ,v l [Wander to v] l ;

[0048] 1.2.2 With probability 1-β, the wanderer has a topological migration probability P t [v j ,v l [Wander to v] l .

[0049] Attribute probability P a [vj ,v l Based on node v j and v l There are many ways to calculate shared attributes. For example, it can be calculated using the following formula:

[0050]

[0051] Among them, P a [v l ,v j ] represents node v j Walk to node v based on attribute probability l The probability of X[v] l ] represents node v l In this embodiment, the node's attributes include user ID, gender, age, occupation, hobbies, and other information. These attributes can be categorized into multi-dimensional data such as identity information, basic information, and behavioral characteristics, used to describe the node's personalized features; V represents the set of all nodes in the graph.

[0052] Topology migration probability is calculated based on the degree of a node, and there are many ways to do this, such as setting it as the reciprocal of the node's out-degree.

[0053] Therefore, in this embodiment, we can obtain the wanderer's starting point from node v. i to v j The probability transition matrix P T [v i ,v j ]=(1-β)P t [v i ,v j ]+βP a [v i ,v j It integrates topology and attribute transfer. Define a graph G(V,E,X), starting node v i Parameters α and β, node v j Relative to v i The attribute enhancement PPR is calculated as follows:

[0054]

[0055] Among them, Π[v i ,v j ] represents node v i Relative to node v j The attribute enhances the PPR value; This indicates that the wanderer starts from node v. i Starting from point v, after k jumps, the node reaches point v. j The probability of.

[0056] The edge weights are redistributed based on the PPR similarity score Π. Specifically, the node similarity of layer 0 is calculated using PPR, which can capture the local and global structure-attribute relationships of the graph. The similarity of other layers is calculated using cosine distance. This dynamic adjustment allows the model to more effectively capture complex interactions between nodes during training. Since adversarial attacks tend to connect less similar node pairs, an edge pruning method based on similarity weights is used to remove unimportant edges. That is, edge weights below a certain threshold T are set to 0, reducing the number of suspicious connections in the graph. After the weight update, the adjacency matrix is ​​calculated as follows:

[0057]

[0058] Among them, S (l) [v i ,v j ] represents node v i With node v j In the similarity value of the l-th layer of the graph neural network, T is a set threshold; A l [v i ,v j To reconstruct node v in the adjacency matrix i With node v j Edge weights; Π[v i ,v j ] represents node v j Relative to node v i Attribute enhancement PPR; X (l) [v i ] represents node v i The feature vector of the l-th layer; X (l) [v j ] T Represents node v j The feature vector X in the l-th layer (l) [v j The transpose of ]; ||·||2 represents the l2 normal form. In this embodiment, when l = 0, according to Π[v i ,v j The adjacency matrix is ​​updated to obtain the output of this layer. When l > 0, the graph data output from the previous layer is first used as the input of the graph convolutional network. The feature vectors of each node in the l-th layer are obtained according to the graph convolutional network. Then, the adjacency matrix is ​​updated according to the similarity of the feature vectors between the nodes. The graph data output from the last layer is used as the final feature vector to predict whether there is a link between two nodes through classifiers, prediction models, etc.

[0059] In graph neural networks, self-loop operations are used to aggregate the features of a node itself, supplementing the information received from its neighbors. However, existing methods directly apply self-loop operations to all nodes indiscriminately, without considering the heterogeneity of the graph or false edges in adversarial attacks. This method adaptively adjusts the self-loop weights based on the node's topological features, balancing the impact of neighboring nodes and the node itself on graph representation learning. The idea behind this method is to increase the weights of neighbors and decrease the weight of the node itself for nodes with many neighbors, and vice versa. Specifically, there are many methods for calculating self-loop weights based on topological features, such as setting the weight of the node itself to be inversely correlated with the degree, which can be expressed as:

[0060]

[0061] Wherein d(v i ) represents the number of edges or out-degree of a node.

[0062] Therefore, the adjacency matrix after self-loop adjustment of the l-th layer graph neural network can be represented as:

[0063]

[0064] Where I represents the identity matrix. In this embodiment, for height nodes, the self-loop weight γ i When γ approaches 0, it means that the proportion of its own features is very small, and most of the adjacency matrix information comes from the information of its neighbors; for low-degree nodes, γ i Approaching 1, this means that neighbor information accounts for a very small proportion, with most information coming from the node's own characteristics. Because high-degree nodes have more neighbors, damaged nodes are blurred and affected by most normal neighbors, so neighbor information accounts for a larger proportion. However, for low-degree nodes, the proportion of neighbor information is larger for damaged nodes, so in this case, they should rely on their own characteristics.

[0065] After the above steps, the adjacency matrix has integrated the similarity score calculated based on attribute augmentation PPR and the adaptive self-loop weights. Since the weights of potentially damaged nodes are reduced, this method weakens the model's sensitivity to malicious perturbations. Then, based on the adjacency matrix and the graph's feature matrix, message propagation is performed in the graph neural network. During the iterative training of the dataset, the weight matrix is ​​learned through feedback optimization of the loss function.

[0066] Based on the above four stages, this embodiment proposes a graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment, as shown in Algorithm 1, which specifically includes:

[0067] In each training epoch e, the graph neural network is iteratively computed layer by layer;

[0068] For each layer l, process each node v in the graph sequentially. i;

[0069] Compute node v i Its neighbor node v j The similarity is considered in this process, which takes into account both the topological structure and attribute features of the graph. In Algorithm 1, Eq.(2) represents S. (l) [v i ,v j The calculation formula for A is Eq.(3), which represents A. (l) [v i ,v j The calculation formula for Π[v] is as follows: According to the calculation formula, in this embodiment, Π[v] is used. i ,v i The value of ] is used as S (l) [v i ,v j The initial value, if it is greater than the set threshold, means that no node pruning is needed in the early stage. This can improve robustness when predicting the relationship between nodes in the later stage.

[0070] Subsequently, based on the calculated similarity, this embodiment prunes edges with low similarity proportionally to obtain the pruned adjacency matrix;

[0071] Next, the self-loop coefficient γ of each node is dynamically calculated based on its out-degree, and the adjacency matrix is ​​further adjusted using this coefficient.

[0072] After the layer-by-layer update, the representation update of the graph neural network is completed based on the adjusted adjacency matrix and input features;

[0073] Subsequently, the error is calculated based on the model's output, and the learnable weight matrix W is updated through backpropagation and gradient descent.

[0074] After multiple rounds of training, the optimized robust graphical neural network f is finally returned, i.e. Where X represents the node feature matrix.

[0075]

[0076] Furthermore, through simulation comparison experiments, the performance of the present invention was compared with that of existing graph neural network models (such as GCN, GAT) and typical adversarial defense methods (such as Jaccard, GNNGuard, RGCN). The experimental results show that in the link prediction task, the present method significantly improves the prediction accuracy and robustness of the model in the adversarial environment.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A graph neural network adversarial defense method based on attribute augmentation principle (PPR) and self-loop weight adjustment, applied to link prediction tasks in graph data, utilizes a defense-optimized graph neural network model to predict potential links in graph data, determines whether a link exists between two nodes, and improves prediction accuracy under adversarial attacks, characterized in that... Specifically, the following steps are included: A node has a certain probability of stopping at the current node or roaming to a neighboring node. When roaming, it has a certain probability of performing topology migration or attribute migration. The similarity between nodes is calculated by considering the topology and attribute features of multi-hop higher-order information. The adjacency matrix is ​​reconstructed by pruning nodes with insufficient similarity based on the similarity scores between nodes and assigning corresponding edge weight values ​​based on the similarity scores between nodes. During message aggregation, the weight of the node itself and its neighboring nodes in the final message is dynamically adjusted based on the out-degree of the target node, so that the neighboring nodes have a larger weight when there are many neighbors, and the node itself has a larger weight when there are few neighbors. Message propagation is performed using the reconstructed adjacency matrix, loss is calculated based on the model output, and the model is optimized through backpropagation. Through iterative message aggregation and propagation, a robust graph neural network with adversarial defense capabilities is trained.

2. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 1, characterized in that, When performing a random walk in graph data, starting from a given starting node... Initially, a random walk was performed using... The probability stops at the current node; with probability 1- Choose the next node with probability, and with probability The next node to be walked is selected based on attribute probability, with a probability of 1- The next node to be traversed is selected based on topological probability.

3. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 2, characterized in that, Attribute Probability Based on nodes Shared attribute calculations are represented as: in, Represents a node Walk to nodes based on attribute probabilities The probability of; Represents a node eigenvectors; This represents the set of all nodes in the graph.

4. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 2, characterized in that, The topology migration probability is calculated based on the degree of the node, that is, it is set as the reciprocal of the node's out-degree.

5. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 1, characterized in that, The edge weights in the reconstructed adjacency matrix are represented as follows: in, Represents a node With nodes In the graph neural network The similarity value of the layers, where T is the set edge weight threshold; For the graph neural network in the 1st Nodes in the layer-reconstructed adjacency matrix With nodes Edge weights; Represents a node Relative to node Enhanced PPR attributes; Represents a node In the The feature vector of the layer; Represents a node In the eigenvectors of the layer transpose; express Paradigm.

6. The graph neural network adversarial defense method based on attribute augmentation (PPR) and self-loop weight adjustment according to claim 5, characterized in that, In a graph data, nodes Relative to node Enhanced PPR properties Represented as: in, For wanderers from nodes After starting, the node is reached after k jumps. The probability of is expressed as , The probability of the walk type, that is, the walker's probability of walking. The probability depends on the node With nodes The probability of attributes between To wander, with The probability depends on the node With nodes Topological migration probability between To wander around; Let be the stopping probability.

7. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 1, characterized in that, During message aggregation, the weight of the node itself and its neighboring nodes in the final message is dynamically adjusted based on the out-degree of the target node, i.e.: = (1- ) + in, The graph neural network with self-loop weights is the first one. Nodes in the layer-reconstructed adjacency matrix and Edge weights; For nodes The self-loop weight decreases as the number of neighboring nodes increases and increases as the number of neighboring nodes decreases. Represents the identity matrix.

8. The graph neural network adversarial defense method based on attribute enhancement PPR and self-loop weight adjustment according to claim 7, characterized in that, The self-loop weight is inversely proportional to the out-degree of the node.

Images