Model extraction attack method and device of graph neural network model, terminal and medium

Abstract

The model extraction attack method, device, terminal and medium of the graph neural network model provided by the application belong to the technical field of network security, and the method comprises the steps of: constructing a substitute model and a generation model; iteratively performing a model extraction attack step until the cumulative query number of the target model reaches a preset number, each iteration comprising: generating target graph data using the generation model, training the substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model; when the training is completed, selecting the substitute model with the first value of the evaluation index in all training rounds as the final substitute model. The application trains the substitute model using the target graph data and / or the historical cache data, which can effectively avoid catastrophic forgetting and reduce the query number of the target model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a model extraction attack method and device of a graph neural network model, a terminal and a medium. BACKGROUND

[0002] Machine Learning as s Service (MLaaS) is a cloud computing service mode, which encapsulates complex machine learning models into simple and easy-to-use services, and provides services to users through the Internet. Users do not need to train models, and only need to submit queries to the cloud machine learning model to use the prediction function of the model. The service provider usually charges the user according to the number of queries. With the continuous development and improvement of graph neural network model (GNN), many MLaaS platforms have integrated the interface services of graph neural network model node classification tasks. These graph neural network models integrated on the MLaaS platform usually face the security threat of network attacks, so it is necessary to study the network attacks of the graph neural network model to improve the robustness and security of the graph neural network model.

[0003] At present, model extraction attack is a relatively mainstream network attack method. This method models the target model as a black box system, generates query data sets iteratively and obtains prediction feedback, aiming to obtain the parameter weight, architecture design or function behavior of the target model. This way needs to launch multiple queries to the target model in the data set construction process, and the number of queries is high. The substitute model only focuses on the current generated sample and the prediction of the target model in each round of training. The substitute model will overfit the new data, and forget the learned input-output mapping relationship before, further increasing the number of queries required by the model extraction attack.

[0004] Therefore, the prior art has defects and needs to be improved and developed. SUMMARY

[0005] The technical problem to be solved by the present application is the above-mentioned defects of the prior art, and a model extraction attack method, device, terminal and medium of a graph neural network model are provided to solve the problem of too high number of queries to the target model in the prior art.

[0006] The technical solution adopted by the present application to solve the technical problem is as follows:

[0007] In a first aspect, the present application provides a model extraction attack method of a graph neural network model, comprising: constructing a substitute model and a generation model, the substitute model is used to simulate the function of a target model, the generation model is used to generate a node feature matrix, and the target model is a graph neural network model.

[0008] The model extraction attack step is iteratively performed until the cumulative number of queries of the target model reaches a preset number, and each iteration includes: generating target graph data using the generation model, training a substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model;

[0009] When the training is completed, the substitute model with the first ranked value of the evaluation index in all training rounds is selected as the final substitute model;

[0010] The historical cache data includes a plurality of o-order subgraphs extracted and screened from the target graph data in each training round, and a hard label and an embedding representation corresponding to a center node of each o-order subgraph, where o is the number of layers of the substitute model.

[0011] In an embodiment, the generation model is used to generate target graph data, including:

[0012] A plurality of random vectors are obtained and input into the generation model to obtain a plurality of node feature matrices;

[0013] The initial graph data is obtained by processing all the node feature matrices;

[0014] The generation model is iteratively trained for a first preset number of times based on the initial graph data to obtain intermediate graph data;

[0015] The intermediate graph data is subjected to a second preset number of self-supervised optimizations to obtain target graph data.

[0016] In an embodiment, the initial graph data is obtained by processing the node feature matrices, including:

[0017] An n x n identity matrix is generated as a basic adjacency matrix according to the number n of nodes in the node feature matrix;

[0018] For each node in the node feature matrix, the cosine similarity of the node with other nodes is calculated, and the nodes with the top k cosine similarities are selected to construct a connection relationship adjacency matrix, which is an n x n binary matrix used to represent the similar connection relationship between nodes, and k is a preset number of neighbor nodes.

[0019] The basic adjacency matrix and the connection relationship adjacency matrix are added to obtain an initial adjacency matrix;

[0020] The node feature matrix and the initial adjacency matrix are combined to obtain the initial graph data.

[0021] In an embodiment, the intermediate graph data is subjected to a second preset round of self-supervised optimization to obtain target graph data, including:

[0022] The node feature matrix of the intermediate graph data is input into a preset structure generator to output a second adjacency matrix;

[0023] The node feature matrix of the intermediate graph data is copied to generate a same first feature matrix and a second feature matrix, an anchor graph data is generated based on the initial adjacency matrix of the intermediate graph data and the first feature matrix, and a second graph data is generated based on the second feature matrix and the second adjacency matrix;

[0024] The anchor graph data and the second graph data are subjected to data augmentation to obtain augmented anchor graph data and augmented second graph data, and the augmented anchor graph data and the augmented second graph data are respectively input into a preset encoder to obtain a feature representation of each node in the augmented anchor graph data and a feature representation of each node in the augmented second graph data;

[0025] A contrastive loss calculation is performed based on the feature representation of each node in the augmented anchor graph data and the feature representation of each node in the augmented second graph data, and parameters of the encoder and parameters of the structure generator are updated in reverse according to a calculation result;

[0026] The process of generating anchor graph data and second graph data, augmenting anchor graph data and second graph data, generating a feature representation of each node in the augmented anchor graph data and a feature representation of each node in the augmented second graph data, and updating parameters of the encoder and parameters of the structure generator is iteratively performed, and after each target round is executed, an adjacency matrix of the anchor graph data is updated;

[0027] After the number of iterations reaches a second preset round, target graph data composed of the node feature matrix of the intermediate graph data and a second adjacency matrix generated in the last iteration is output.

[0028] In an embodiment, before the iterative model extraction attack step is performed, the method further includes:

[0029] A prediction label category of the target model is obtained;

[0030] A corresponding cache module is created for each prediction label category to store cache data of the prediction label category.

[0031] In an embodiment, a substitute model is trained using target graph data and / or historical cache data, including:

[0032] When a first round of training is performed, the substitute model is trained using target graph data;

[0033] From the second round of training, the target graph data and the historical cache data are used to train the substitute model, including:

[0034] The target graph data generated in the current round are input into the target model and the substitute model respectively, to obtain hard labels output by the target model for each node in the target graph data and first prediction labels output by the substitute model for each node in the target graph data;

[0035] For each node in the target graph data, a first cross-entropy loss between the hard label and the first prediction label is calculated, and the parameters of the substitute model are updated through gradient back propagation;

[0036] The historical cache data is collected according to the prediction label category, to obtain a plurality of o-order subgraphs, and the o-order subgraphs are combined into combined graph data and input into the substitute model, to obtain second prediction labels output by the substitute model;

[0037] For each node in the combined graph data, a second cross-entropy loss between the second prediction label and the corresponding hard label in the historical cache data is calculated, and the parameters of the substitute model are updated through gradient back propagation.

[0038] In an embodiment, the substitute model is evaluated, including:

[0039] A test data set is obtained, which contains a plurality of test samples and corresponding true labels;

[0040] The test data set is input into the substitute model trained in the current round and the target model respectively, to obtain third prediction labels of each test sample output by the substitute model trained in the current round and test sample hard labels of each test sample output by the target model;

[0041] Based on the third prediction label of each test sample and the corresponding true label, processing is performed to obtain an accuracy index of the substitute model trained in the current round;

[0042] Based on the third prediction label of each test sample and the test sample hard label, processing is performed to obtain a consistency index of the substitute model trained in the current round.

[0043] In a second aspect, an embodiment of the present application also provides a model extraction attack device of a graph neural network model, the device comprising:

[0044] A model construction module is configured to construct a substitute model and a generation model, the substitute model is configured to simulate the function of a target model, the generation model is configured to generate a node feature matrix, and the target model is a graph neural network model;

[0045] The extraction attack module is configured to iteratively perform a model extraction attack step until a cumulative query number of the target model reaches a preset number, and each iteration includes: generating target graph data by using the generation model, training a substitute model by using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model, wherein the historical cache data includes a plurality of o-order subgraphs extracted and filtered based on the target graph data generated in each training round, and hard labels and embedding representations corresponding to center nodes of each o-order subgraph, and o is a number of layers of the substitute model.

[0046] The final substitute model determination module is configured to select, when the training is completed, a substitute model with a value of an evaluation index ranked first in all training rounds as a final substitute model.

[0047] In a third aspect, an embodiment of the present application further provides a terminal, which comprises a memory, a processor, and a model extraction attack program of a graph neural network model stored in the memory and capable of running on the processor, and the model extraction attack program of the graph neural network model implements steps of the model extraction attack method of the graph neural network model when executed by the processor.

[0048] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium storing a model extraction attack program of a graph neural network model, and the model extraction attack program of the graph neural network model can be executed to implement steps of the model extraction attack method of the graph neural network model.

[0049] The present application has the following beneficial effects: the present application constructs a substitute model and a generation model, iteratively performs a model extraction attack step until a cumulative query number of the target model reaches a preset number, and each iteration includes: generating target graph data by using the generation model, training a substitute model by using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model, and when the training is completed, a substitute model with a value of an evaluation index ranked first in all training rounds is selected as a final substitute model. The present application trains a substitute model by using target graph data and / or historical cache data, can effectively avoid catastrophic forgetting, and further reduces a query number of the target model. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a flowchart of a preferred embodiment of the model extraction attack method of the graph neural network model in the present application.

[0051] Figure 2 is a schematic diagram of a training process of the generation model in the present application.

[0052] Figure 3 is a flowchart of the process of optimizing intermediate graph data in the present application.

[0053] Figure 4 is a flowchart of the process of the surrogate model training stage in the present application.

[0054] Figure 5 is a structural diagram of a preferred embodiment of a model extraction attack device of a graph neural network model in the present application.

[0055] Figure 6 is a structural diagram of a terminal in the present application. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present application clearer and more explicit, the present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0057] Machine Learning as a Service (MLaaS) is a cloud computing service mode that encapsulates complex machine learning models into simple and easy-to-use services and provides services to users through the Internet. Users do not need to train models, but only need to submit queries to the cloud machine learning model to use the prediction function of the model, and the service provider usually charges the user according to the number of queries. With the continuous development and improvement of graph neural network models (GNN), many MLaaS platforms have integrated the interface services of graph neural network model node classification tasks. These graph neural network models integrated on the MLaaS platform often face the security threat of network attacks, so it is necessary to study the network attacks of graph neural network models to improve the robustness and security of graph neural network models.

[0058] Currently, model extraction attack is a relatively mainstream network attack method. This method models the target model as a black box system, generates query data sets iteratively and obtains prediction feedback, aiming to obtain the parameter weights, architecture design or functional behavior of the target model. This way needs to launch multiple queries to the target model in the data set construction process, and the number of queries is high. The surrogate model only focuses on the current generated sample and the prediction of the target model in each round of training, and the surrogate model will overfit the new data and forget the learned input-output mapping relationship before, further increasing the number of queries required by the model extraction attack.

[0059] In view of the above defects of the prior art, the present application provides a model extraction attack method and device of a graph neural network model, a terminal and a medium, the method comprising: constructing a substitute model and a generation model; iteratively performing a model extraction attack step until the cumulative number of queries of the target model reaches a preset number, each iteration comprising: generating target graph data using the generation model, training the substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model; and when the training is completed, selecting the substitute model with the first value of the evaluation index in the sorting of all training rounds as the final substitute model. The present application trains the substitute model using the target graph data and / or historical cache data, which can effectively avoid catastrophic forgetting and thus reduce the number of queries of the target model.

[0060] See Figure 1 The model extraction attack method of the graph neural network model according to an embodiment of the present application comprises the following steps:

[0061] Step S100, constructing a substitute model and a generation model, the substitute model being used to simulate the function of a target model, and the generation model being used to generate a node feature matrix, the target model being a graph neural network model.

[0062] Specifically, since the graph neural network model generally adopts the MPNN (Message Passing Neural Network) framework, the structures of different graph neural network models aggregate the information of adjacent nodes using similar message passing mechanisms and update the node representation step by step. Therefore, when the structure of the substitute model is different from that of the target model, the attack is still feasible. The substitute model can be selected from commonly used graph neural network models, such as the graph convolutional neural network (GCN), the graph sample and aggregate network (GraphSAGE), the graph attention network (GAT), etc., without limitation. In addition, the hyperparameters of the substitute model are set according to the task characteristics of the target model. For example, when the task type of the target model is the node type of a social network, the important relationships between nodes exist within 1-3 hops, so the number of hidden layers of the substitute network is usually set to no more than 3. The generation model is responsible for generating the node feature matrix of the graph. The node feature matrix is a matrix of dimensions composed of all node feature vectors of the graph, representing the number of nodes, Representative feature dimensions. Thus, a Multilayer Perceptron (MLP) can be used as the generative model. After determining the surrogate model and the generative model, the parameters of the surrogate model and the parameters of the generative model are randomly initialized.

[0063] See Figure 1 The model extraction attack method of the graph neural network model according to the embodiment of the application further includes the following steps:

[0064] Step S200, iteratively perform the model extraction attack step until the cumulative query number of the target model reaches a preset number, and each iteration includes: generating target graph data using the generative model, training the surrogate model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the surrogate model.

[0065] Specifically, the historical cache data includes a plurality of o-order subgraphs extracted and filtered from the target graph data in each round of training, and a hard label and an embedding representation corresponding to a center node of each o-order subgraph, o being the number of layers of the surrogate model. Since the number of queries to the target model per day is limited, the number of queries to the target model when training the surrogate model cannot exceed the preset number.

[0066] In an implementation manner, the target graph data is generated using the generative model, including:

[0067] A plurality of random vectors are obtained and input into the generative model to obtain a plurality of node feature matrices;

[0068] The initial graph data is obtained based on processing of all the node feature matrices;

[0069] The intermediate graph data is obtained based on first preset iteration training of the generative model based on the initial graph data;

[0070] The target graph data is obtained based on second preset self-supervised optimization of the intermediate graph data.

[0071] Specifically, before obtaining the random vector, a preset noise distribution is sampled to generate the random vector, and the random vector obeys a Gaussian distribution , and is expressed as The random vector obeying the Gaussian distribution is input into the generative model , and a node feature matrix can be obtained. This process can be expressed as , wherein is a parameter of the generative model.

[0072] In an implementation, processing based on the node feature matrix obtains initial graph data, including:

[0073] According to the number n of nodes of the node feature matrix, a unit matrix of n*n dimension is generated as a basic adjacency matrix;

[0074] For each node in the node feature matrix, the cosine similarity of the node with other nodes is calculated, and the nodes with the top k cosine similarity are selected to construct a connection relationship matrix, the connection relationship matrix is a binary matrix of n*n dimension, used to represent the similar connection relationship between nodes, and k is a preset number of neighbor nodes;

[0075] The basic adjacency matrix and the connection relationship adjacency matrix are added to obtain an initial adjacency matrix;

[0076] The node feature matrix and the initial adjacency matrix are combined as initial graph data.

[0077] Specifically, the basic adjacency matrix can be represented as The cosine similarity between any two points in the node feature matrix is calculated using the following formula: . In the formula, represents the cosine similarity between node and node , is the feature vector of node , is the feature vector of node . For each node in the node feature matrix, the KNN algorithm is used to select the nodes with the top k cosine similarity with the node, and k is a preset number of neighbor nodes. Then, a zero matrix of n*n dimension is initialized, and the zero matrix is assigned a value using the following formula:

[0078] ;

[0079] In the formula, is an element of the zero matrix, indicates that the neighbor node with the top k cosine similarity with node u is selected. If node v is a neighbor node with the top k cosine similarity with node u, the u-th row and v-th column of the zero matrix is assigned a value of 1, indicating that the two nodes are connected, otherwise the u-th row and v-th column of the zero matrix is assigned a value of 0. In this way, each node in the node feature matrix is processed to obtain a connection relationship adjacency matrix .

[0080] The initial adjacency matrix is represented as: . After obtaining the initial adjacency matrix, the node feature matrix and the initial adjacency matrix The initial graph data jointly constitute, which can be expressed as .

[0081] After obtaining the initial graph data, the generative model needs to be trained based on the initial graph data to construct graph data approximating the real data distribution. Before training the generative model, the prediction label categories of the target model are obtained. If the prediction label categories are , the category set can be expressed as . Then a pseudo label is randomly generated for each node in the initial graph data , and the pseudo label is uniformly collected from the category set of the target model, which is expressed as: , wherein represents a discrete uniform distribution, i is the node index, is the pseudo label corresponding to the i-th node.

[0082] Then, the step of training the generative model is executed, the initial graph data is input into the substitute model, and the first preset number of iterations of the generative model is trained with the optimization objective of minimizing the first cross-entropy loss function. The optimization objective is expressed as: , wherein is the substitute model, is the initial graph data, is the first cross-entropy loss function, is the parameter of the substitute model. After each training, the parameters of the generative model are updated according to the gradient of back propagation. The training process of the generative model is shown in Figure 2 .

[0083] Since the optimization direction of the generative model and the substitute model is the same at this time, both are to minimize the difference between the output result of the substitute model and the random label, so this optimization strategy is in the form of cooperation. After executing the optimization process for the first preset number of times , and comparing the loss of each round, the initial graph data with the minimum loss in the first preset number of times is taken as the intermediate graph data . It can be understood that the intermediate graph data also contains the node feature matrix and the initial adjacency matrix.

[0084] In the prior art, a more common model attack method is a data-free model extraction attack method, which uses a generated model to generate data and eliminates the dependence on the original training data of the target model. In the execution process of the data-free model extraction attack, the generated model is optimized, so that the data generated by the model gradually converges to the original training data of the target model in distribution. The existing data-free model extraction attack for graph neural networks adopts an adversarial generated model optimization strategy, that is, the optimization objectives of the generated model and the substitute model are completely opposite. Because the generated model needs to be adjusted frequently and the optimization direction is uncontrollable, the number of queries required by the adversarial generated model optimization strategy is too high. However, the optimization objectives of the generated model and the substitute model of the present application are consistent, the generated model and the substitute model share the loss function, and the prediction error is minimized. The generated model maximizes the confidence of the substitute model to generate high-quality samples, and the substitute model trained using these samples is more similar in function to the target model, which can further guide the generated model to generate samples closer to the training set of the target model, thereby forming a collaborative optimization. Compared with the adversarial optimization method, the collaborative optimization method makes the training of the generator more stable, so the number of queries required is less.

[0085] In an implementation manner, the intermediate graph data is subjected to second preset rounds of self-supervised optimization to obtain target graph data, including:

[0086] The node feature matrix of the intermediate graph data is input into a preset structure generator to output a second adjacency matrix;

[0087] The node feature matrix of the intermediate graph data is copied to generate a same first feature matrix and a second feature matrix, an anchor graph data is generated based on the initial adjacency matrix of the intermediate graph data and the first feature matrix, and a second graph data is generated based on the second feature matrix and the second adjacency matrix;

[0088] The anchor graph data and the second graph data are subjected to data augmentation to obtain augmented anchor graph data and augmented second graph data, and the augmented anchor graph data and the augmented second graph data are respectively input into a preset encoder to obtain the feature representation of each node in the augmented anchor graph data and the feature representation of each node in the augmented second graph data;

[0089] A contrastive loss calculation is performed based on the feature representation of each node in the augmented anchor graph data and the feature representation of each node in the augmented second graph data, and the parameters of the encoder and the parameters of the structure generator are updated in reverse according to the calculation result;

[0090] The execution of the iteration generates a process of generating anchor graph data and second graph data, enhancing anchor graph data and second graph data, generating feature representations of each node in enhanced anchor graph data and feature representations of each node in enhanced second graph data, and updating parameters of the encoder and parameters of the structure generator, and after each execution of a target round, updating an adjacency matrix of the anchor graph data;

[0091] After the number of iterations reaches a second preset round, the target graph data composed of the node feature matrix of the intermediate graph data and the second adjacency matrix generated by the last iteration is output.

[0092] Specifically, the second preset round of self-supervised optimization of the intermediate graph data to obtain the target graph data can be regarded as further optimization of the intermediate graph data, and a flowchart is shown in Figure 3 The graph structure is strengthened by self-supervised contrast learning, which can mine more rich adjacency relationships between nodes. Since the initial graph data is obtained according to the cosine similarity between nodes, it fails to fully mine the connections between nodes compared with the graph data in the real data, so that the intermediate graph data obtained from the initial graph data also fails to fully mine the connections between nodes, and direct use will affect the training effect of the surrogate model. Therefore, before training the surrogate model, the intermediate graph data needs to be further optimized.

[0093] Before the optimization process, a structure generator is preset. The structure generator includes a multi-layer graph convolutional neural network (GCN). The node feature matrix of the intermediate graph data is input into the preset structure generator, neighbor information is aggregated through the multi-layer graph convolutional neural network, and a node embedding matrix is output. Each element in the embedding matrix represents a node embedding vector of each node. The cosine similarity between any two nodes in the embedding matrix is calculated as a connection probability, a probability matrix is composed of the calculation results of the cosine similarity of all nodes, and a second adjacency matrix can be obtained by sparsifying the probability matrix. Wherein, is a parameter of the structure generator.

[0094] The node feature matrix of the intermediate graph data is copied to generate the same first feature matrix and second feature matrix . The structure of the intermediate graph data (i.e., the initial adjacency matrix of the intermediate graph data) is taken as an anchor to generate anchor graph data . After generating the second adjacency matrix , it is combined with the second feature matrix to form the second graph data .

[0095] After generating the anchor graph data and the second graph data, data augmentation is performed on the anchor graph data and the second graph data. Specifically, two dimensional feature mask vectors are randomly generated using uniform distribution and , and then the first feature matrix of the anchor graph data is masked using the mask vector , which can be represented as , and the enhanced first feature matrix is obtained after the operation. Similarly, the second feature matrix of the second graph data is masked using the mask feature vector , which can be represented as , and the enhanced second feature matrix is obtained after the operation. Then, based on the initial adjacency matrix A and the enhanced first feature matrix, the enhanced anchor graph data is obtained. Based on the second adjacency matrix and the enhanced second feature matrix, the enhanced second graph data is obtained.

[0096] After data augmentation, a preset graph encoder is used to generate a first encoding result, i.e., the embedding representation of each node in the enhanced anchor graph data , and a second encoding result, i.e., the embedding representation of each node in the enhanced second graph data , wherein is the parameter of the graph encoder .

[0097] Based on the feature representation of each node in the enhanced anchor graph data and the feature representation of each node in the enhanced second graph data, a contrastive loss calculation is performed, and the formula is as follows:

[0098] ;

[0099] ;

[0100] ;

[0101] wherein the node representation of the i-th node in the enhanced anchor graph data is , and the node representation of the i-th node in the enhanced second graph data is ; is the contrastive loss function, and the similarity between the corresponding representations of each node in and is calculated, wherein and are two directional contrastive loss terms, comparing the similarity of positive sample pairs with the similarity of all negative sample pairs , is a normalization factor to ensure the loss value is not affected by the number of samples; represents the cosine similarity function; t represents the temperature coefficient, which is used to reduce the impact of training overfitting.

[0102] After calculating the contrastive loss each time, the parameters of the structure generator and the encoder are updated according to the gradient of back propagation.

[0103] In order to ensure that the generated graph data is close to the real data, the anchor point graph structure needs to provide sufficient supervision information, and the anchor point graph structure (i.e. the second adjacency matrix of the anchor point graph) is updated once every target round is executed. The update formula is as follows: , wherein is the degradation rate, is the updated anchor point graph structure.

[0104] In an implementation mode, before the model extraction attack step is iteratively executed, it further includes:

[0105] obtaining the prediction label categories of the target model;

[0106] creating a corresponding cache module for each of the prediction label categories, respectively, for storing the cache data of the prediction label category.

[0107] Specifically, in order to prevent catastrophic forgetting during training, a corresponding cache module is created for each prediction label category of the target model to store the o-order subgraph selected after each training. The o-order subgraph is a local subgraph centered on any node in the graph, including all o-hop neighbor nodes and associated edges. Then, after training the substitute model using the label output by the target model, the historical cache data is uniformly selected from the cache module to train the substitute model. By training the substitute model in this way, combining the hard label of the target model and the sampled historical data, catastrophic forgetting can be effectively prevented, and the knowledge transfer efficiency and generalization ability of the substitute model can be improved.

[0108] Training the substitute model using the target graph data and / or historical cache data includes:

[0109] When performing the first round of training, the substitute model is trained using the target graph data;

[0110] Starting from the second round of training, the substitute model is trained using the target graph data and the historical cache data, including:

[0111] input the target graph data generated in the current round into the target model and the substitute model respectively to obtain hard labels output by the target model for each node in the target graph data and first prediction labels output by the substitute model for each node in the target graph data;

[0112] For each node in the target graph data, a first reverse cross-entropy loss between the hard label and the first prediction label is calculated, and the parameters of the substitute model are updated through gradient back propagation;

[0113] For each node in the target graph data, a first reverse cross-entropy loss between the hard label and the first prediction label is calculated, and the parameters of the substitute model are updated through gradient back propagation;

[0114] For each node in the target graph data, a first reverse cross-entropy loss between the hard label and the first prediction label is calculated, and the parameters of the substitute model are updated through gradient back propagation.

[0115] Specifically, since the cache data is extracted and selected according to the target graph data, there is no historical cache data at the first time of training, at this time, the target graph data is directly used to train the substitute model, and the cache data is obtained by extracting and selecting according to the target graph data. From the second training, since there is historical cache data, the target graph data and the historical cache data are used to train the substitute model together.

[0116] After inputting the target graph data into the target model, the hard label of each node in the target graph data, i.e. the label with the maximum prediction confidence, can be obtained, which can be represented as:

[0117] ;

[0118] wherein, is the target graph data, is the target model, n is the number of nodes of the target graph data, c is the number of prediction label categories of the target model, and i and l are subscripts.

[0119] The first reverse cross-entropy loss function is represented as: , represents the first prediction label output by the substitute model for each node in the target graph data.

[0120] When the substitute model is trained with the target graph data, equal amounts of o-order subgraphs are randomly sampled from all cache modules to combine into combined graph data , the hard label of the center node of each o-order subgraph is It is also stored in the corresponding cache module, and the combined graph data and the hard labels of the central nodes of the o-order subgraph within it are used to strengthen the training of the substitute model to prevent catastrophic forgetting of the substitute model.

[0121] The second inverse cross entropy loss function is expressed as: , The second predicted label output by the surrogate model for each node in the combined graph data.

[0122] After training is completed, the cached data needs to be updated. Specifically, for each node in the target graph data, an o-order subgraph is extracted and filtered. The specific screening process is as follows: the amount of information of each o-order subgraph center node is measured, that is, the information score is calculated. The calculation formula is:

[0123] ;

[0124] in, represents the uncertainty fraction, which is calculated as follows:

[0125] , Representative The central node corresponding to the o-order subgraph, is the i-th o-order subgraph, is the predicted label output by the replacement model, Y is the number of predicted labels output by the replacement model, and P represents the calculated probability. is the representative score, which is calculated as follows: , where is the embedding representation of the central node corresponding to the i-th o-order subgraph, Represents the calculation of Euclidean distance. The cluster center corresponding to the samples of each category is obtained by averaging the embedding representations of the central nodes of the target o-order subgraph stored in the cache module of that category. After calculating the information score of each o-order subgraph, the o-order subgraphs with information scores higher than the preset threshold are screened out, and the hard labels and embedding representations corresponding to the screened o-order subgraphs and the central nodes of the o-order subgraphs are stored in the cache module of the corresponding predicted label category to complete the update of the cache data. The flow diagram of the alternative model training phase is shown in the figure below. Figure 4 As shown in the figure, while using new data to train the surrogate model, the present invention evenly samples historical samples from the cache modules of all predicted label categories to perform intensive training on the surrogate model. This method can prevent the surrogate model from forgetting the input-output mapping relationship learned previously during the process of continuously learning new data, effectively avoiding catastrophic forgetting.

[0126] In one implementation, evaluating the surrogate model includes:

[0127] obtaining a test data set, the test data set comprising a plurality of test samples and corresponding true labels;

[0128] inputting the test data set into the surrogate model and the target model after the current round of training respectively to obtain third predicted labels of each test sample output by the surrogate model after the current round of training and test sample hard labels of each test sample output by the target model;

[0129] processing the third predicted labels and the test sample hard labels of each test sample to obtain an accuracy index of the surrogate model after the current round of training;

[0130] obtaining a consistency index of the surrogate model after the current round of training based on the number of samples whose third predicted labels are consistent with the test sample hard labels and the total number of test samples.

[0131] Specifically, the evaluation index of the surrogate model comprises the accuracy index and the consistency index. The accuracy index refers to the matching degree between the predicted labels of the surrogate model and the true labels. The consistency index refers to the similarity between the predicted labels of the surrogate model and the hard labels of the target model.

[0132] obtaining a test data set , is the i th sample, is the true label corresponding to the i th sample, is the number of samples. The calculation formula of the accuracy index is as follows:

[0133] ;

[0134] in the formula, represents an indicator function, is the test sample hard label of the i th test sample output by the target model, is the third predicted label of the i th test sample output by the surrogate model. When , the value is 1, otherwise 0.

[0135] The calculation formula of the consistency index is as follows:

[0136] ;

[0137] in the formula, is the test sample hard label of the i th test sample output by the target model. When , the value is 1, otherwise 0.

[0138] Please refer to Figure 1 , the model extraction attack method of the graph neural network model according to the embodiment of the application further comprises the following steps:

[0139] Step S300: Select the surrogate model with the highest ranking of evaluation index values ​​in all training rounds as the final surrogate model.

[0140] Specifically, since both accuracy and consistency are calculated for each round of surrogate model evaluation, the user can choose to use either of these as the evaluation metric, and select the surrogate model with the highest ranking accuracy across all training rounds as the final surrogate model. For example, if the user selects accuracy as the evaluation metric, the surrogate model with the highest ranking accuracy across all training rounds will be selected as the final surrogate model.

[0141] In summary, the present invention constructs a substitution model and a generative model; iteratively executes the model extraction attack step until the cumulative number of queries for the target model reaches a preset number. Each iteration includes: generating target graph data using the generative model, training the substitution model using the target graph data and / or historical cached data, updating the historical cached data based on the target graph data, and evaluating the substitution model. When training is complete, the substitution model that ranks first in the evaluation index value across all training rounds is selected as the final substitution model. The present invention uses target graph data and / or historical cached data to train the substitution model, effectively avoiding catastrophic forgetting and thereby reducing the number of target model queries.

[0142] In one embodiment, if Figure 5 As shown, based on the above-mentioned model extraction attack method of a graph neural network model, the present invention also provides a model extraction attack device for a graph neural network model, the device comprising:

[0143] A model construction module 100 is used to construct a substitute model and a generative model. The substitute model is used to simulate the function of the target model, and the generative model is used to generate a node feature matrix. The target model is a graph neural network model.

[0144] An extraction attack module 200 is configured to iteratively execute the model extraction attack step until the cumulative number of queries for the target model reaches a preset number, wherein each iteration includes: generating target graph data using the generation model, training a substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model, wherein the historical cache data includes a plurality of o-order subgraphs extracted and filtered based on the target graph data generated in each round of training, as well as a hard label and an embedded representation corresponding to the central node of each o-order subgraph, where o is the number of layers of the substitute model;

[0145] The final alternative model determination module 300 is used to select the alternative model with the highest ranking of evaluation index values ​​in all training rounds as the final alternative model when training is completed.

[0146] It should be noted that the foregoing explanation of the model extraction attack method embodiment of the graph neural network model also applies to the model extraction attack device of the graph neural network model of this embodiment, which will not be described here.

[0147] Based on the above-mentioned embodiments, the present application also provides a terminal, the structure diagram of which can be as shown in Figure 6 The terminal includes a processor, a memory, a network interface and a display screen connected through a device bus. The processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating device and a model extraction attack program of a graph neural network model. The internal memory provides an environment for the operation of the operating device and the model extraction attack program of the graph neural network model in the non-volatile storage medium. The network interface of the terminal is used to communicate with external terminals through network connection. The model extraction attack program of the graph neural network model is executed by the processor to realize the steps of any model extraction attack method of the graph neural network model. The display screen of the terminal can be a liquid crystal display screen or an electronic ink display screen.

[0148] Those skilled in the art can understand that Figure 6 The structure diagram shown in the figure is only a schematic diagram of part of the structure related to the present application scheme, and does not constitute a limitation on the terminal to which the present application scheme is applied. The specific terminal can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0149] In one embodiment, a terminal is provided, which includes a memory, a processor, and a model extraction attack program of a graph neural network model stored on the memory and executable on the processor. When the model extraction attack program of the graph neural network model is executed by the processor, the steps of any model extraction attack method of the graph neural network model provided by the present application embodiment are realized.

[0150] The present application embodiment also provides a computer readable storage medium, which stores a model extraction attack program of a graph neural network model. When the model extraction attack program of the graph neural network model is executed by the processor, the steps of any model extraction attack method of the graph neural network model provided by the present application embodiment are realized.

[0151] It should be understood that the serial numbers of the steps in the above-mentioned embodiments do not mean the order of execution. The execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the present application embodiment.

[0152] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the above-mentioned device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be realized in the form of hardware or software. In addition, the specific names of each functional unit and module are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0153] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0154] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0155] In the embodiments provided by the present application, it should be understood that the disclosed device / terminal equipment and method can be implemented by other ways. For example, the device / terminal equipment embodiments described above are only schematic, for example, the division of the above-mentioned modules or units is only a logical function division, and actual implementation can be different, for example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0156] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand; it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not deviate from the spirit and scope of the corresponding technical solutions, and should be included in the protection scope of the present application.

Claims

1. A model extraction attack method of a graph neural network model, characterized in that, The method comprises: constructing a substitute model for simulating the function of a target model and a generation model for generating a node feature matrix, the target model being a graph neural network model; iteratively performing a model extraction attack step until the cumulative number of queries of the target model reaches a preset number, each iteration comprising: generating target graph data using the generation model, training the substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model; when the training is completed, selecting the substitute model with the first ranking value of the evaluation index in all training rounds as the final substitute model; wherein the historical cache data comprises a plurality of o-order subgraphs extracted and screened from the target graph data in each training round, and a hard label and an embedding representation corresponding to the center node of each o-order subgraph, o being the number of layers of the substitute model; generating target graph data using the generation model comprises: obtaining a plurality of random vectors and inputting them into the generation model to obtain a plurality of node feature matrices; processing all the node feature matrices to obtain initial graph data; performing first preset rounds of iterative training on the generation model based on the initial graph data to obtain intermediate graph data; performing second preset rounds of self-supervised optimization on the intermediate graph data to obtain target graph data; training the substitute model using the target graph data and / or the historical cache data comprises: when the first round of training is performed, training the substitute model using the target graph data; starting from the second round of training, training the substitute model using the target graph data and the historical cache data, comprising: inputting the target graph data generated in the current round into the target model and the substitute model respectively to obtain the hard label output by the target model for each node in the target graph data and the first predicted label output by the substitute model for each node in the target graph data; for each node in the target graph data, calculating the first cross-entropy loss between the hard label and the first predicted label, and updating the parameters of the substitute model through gradient backpropagation; equally collecting the historical cache data according to the predicted label category to obtain a plurality of o-order subgraphs, combining all the o-order subgraphs into combined graph data and inputting them into the substitute model to obtain the second predicted label output by the substitute model; for each node in the combined graph data, calculating the second cross-entropy loss between the second predicted label and the corresponding hard label in the historical cache data, and updating the parameters of the substitute model through gradient backpropagation; evaluating the substitute model comprises: obtaining a test data set containing a plurality of test samples and corresponding true labels; inputting the test data set into the substitute model and the target model after the current round of training respectively to obtain the third predicted label output by the substitute model for each test sample and the test sample hard label output by the target model for each test sample; processing the third predicted label of each test sample and the corresponding true label to obtain the accuracy index of the substitute model after the current round of training; Processing based on the third predicted label of each test sample and the test sample hard label, obtaining the consistency index of the surrogate model after this round of training.

2. The model extraction attack method of the graph neural network model according to claim 1, characterized in that, Processing based on the node feature matrix, obtaining initial graph data, including: According to the number n of nodes of the node feature matrix, a unit matrix with a dimension of n*n is generated as a basic adjacency matrix; For each node in the node feature matrix, the cosine similarity between the node and other nodes is calculated, and the nodes with the top k cosine similarity are selected to construct a connection relationship adjacency matrix, the connection relationship adjacency matrix is a binary matrix with a dimension of n*n, used to represent the similar connection relationship between nodes, and k is a preset number of neighbor nodes; Adding the basic adjacency matrix and the connection relationship adjacency matrix to obtain an initial adjacency matrix; Combining the node feature matrix and the initial adjacency matrix into initial graph data.

3. The model extraction attack method of the graph neural network model according to claim 1, characterized in that, Performing second preset rounds of self-supervised optimization on the intermediate graph data to obtain target graph data, including: Inputting the node feature matrix of the intermediate graph data into a preset structure generator to output a second adjacency matrix; Copying the node feature matrix of the intermediate graph data to generate the same first feature matrix and second feature matrix, generating anchor graph data based on the initial adjacency matrix of the intermediate graph data and the first feature matrix, and generating second graph data based on the second feature matrix and the second adjacency matrix; Performing data enhancement on the anchor graph data and the second graph data to obtain enhanced anchor graph data and enhanced second graph data, and inputting the enhanced anchor graph data and the enhanced second graph data into a preset encoder to obtain the feature representation of each node in the enhanced anchor graph data and the feature representation of each node in the enhanced second graph data; Based on the feature representation of each node in the enhanced anchor graph data and the feature representation of each node in the enhanced second graph data, a contrastive loss is calculated, and the parameters of the encoder and the parameters of the structure generator are updated according to the calculation result; Iteratively performing the processes of generating anchor graph data and second graph data, enhancing anchor graph data and second graph data, generating feature representation of each node in enhanced anchor graph data and feature representation of each node in enhanced second graph data, and updating parameters of the encoder and parameters of the structure generator, and updating the adjacency matrix of the anchor graph data after each target round is executed. After the number of iterations reaches the second preset number of rounds, the target graph data composed of the node feature matrix of the intermediate graph data and the second adjacency matrix generated by the last iteration is output.

4. The model extraction attack method of a graph neural network model according to claim 1, characterized in that, Before iteratively performing the model extraction attack step, further comprising: Obtaining the predicted label categories of the target model; Creating a corresponding cache module for each of the predicted label categories for storing cache data of the predicted label category.

5. An apparatus for model extraction attack of a graph neural network model, comprising: Including: A model construction module for constructing a surrogate model and a generation model, the surrogate model is used to simulate the function of the target model, and the generation model is used to generate a node feature matrix, and the target model is a graph neural network model; The extraction attack module is configured to iteratively perform a model extraction attack step until a cumulative number of queries of the target model reaches a preset number, and each iteration includes: generating target graph data using a generative model, training a substitute model using the target graph data and / or historical cache data, updating the historical cache data based on the target graph data, and evaluating the substitute model, wherein the historical cache data includes a plurality of o-order subgraphs extracted and filtered based on the target graph data generated in each round of training, and a hard label and an embedding representation corresponding to a center node of each o-order subgraph, and o is a number of layers of the substitute model; The target graph data is generated using the generative model, including: Obtaining a plurality of random vectors and inputting the generative model to obtain a plurality of node feature matrices; Processing based on all the node feature matrices to obtain initial graph data; Performing first preset rounds of iterative training on the generative model based on the initial graph data to obtain intermediate graph data; Performing second preset rounds of self-supervised optimization on the intermediate graph data to obtain target graph data; The substitute model is trained using the target graph data and / or the historical cache data, including: When performing the first round of training, the substitute model is trained using the target graph data; Starting from the second round of training, the substitute model is trained using the target graph data and the historical cache data, including: Inputting the target graph data generated in the current round into the target model and the substitute model respectively to obtain a hard label output by the target model for each node in the target graph data and a first prediction label output by the substitute model for each node in the target graph data; For each node in the target graph data, a first cross-entropy loss between the hard label and the first prediction label is calculated, and the parameters of the substitute model are updated through gradient backpropagation; The historical cache data is collected according to the prediction label category to obtain a plurality of o-order subgraphs, and all the o-order subgraphs are combined into combined graph data and input into the substitute model to obtain a second prediction label output by the substitute model; For each node in the combined graph data, a second cross-entropy loss between the second prediction label and the corresponding hard label in the historical cache data is calculated, and the parameters of the substitute model are updated through gradient backpropagation; The substitute model is evaluated, including: Obtaining a test data set containing a plurality of test samples and corresponding true labels; Inputting the test data set into the substitute model and the target model after the current round of training respectively to obtain a third prediction label output by the substitute model for each test sample and a test sample hard label output by the target model for each test sample; Based on the third prediction label of each test sample and the corresponding true label, an accuracy index of the substitute model after the current round of training is obtained; Based on the third prediction label of each test sample and the test sample hard label, a consistency index of the substitute model after the current round of training is obtained; The final substitute model determination module is configured to select a substitute model with the first ranking of evaluation index value in all training rounds as the final substitute model when the training is completed.

6. A terminal, characterized by comprising: The terminal comprises a memory, a processor, and a model extraction attack program of a graph neural network model stored on the memory and executable on the processor, and the model extraction attack program of the graph neural network model, when executed by the processor, implements the steps of the model extraction attack method of the graph neural network model according to any one of claims 1-4.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores a model extraction attack program of a graph neural network model, and the model extraction attack program of the graph neural network model, when executed by the processor, implements the steps of the model extraction attack method of the graph neural network model according to any one of claims 1-4.

Images