Graph confrontation defense method based on Schmidt Hilbert correlation measurement
Through the graph adversarial defense method based on Schmidt-Hilbert correlation metric, neighbor information is used for node denoising and the Schmidt-Hilbert loss function is constructed, which solves the robustness problem of graph neural networks under influence maximization attacks and improves the adversarial robustness of the model and the relevance of downstream tasks.
Patent Information
- Application Number
- CN202510873162.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-27
- Publication Date
- 2025-09-26
AI Technical Summary
When facing influence-maximizing attacks, existing defense methods for graph neural network models cannot effectively improve the model's adversarial robustness, resulting in a significant decline in model performance. Especially in graph data scenarios, existing defense methods cannot effectively prevent global performance degradation caused by small perturbations.
A graph adversarial defense method based on Schmidt-Hilbert correlation metric is adopted. Through system initialization, node denoising, graph neural network backbone module and category perception module, neighbor information is used for parameter-free learning of node denoising, and a Schmidt-Hilbert loss function is constructed to enhance the adversarial robustness of the model.
In the absence of known disturbance knowledge, neighbor information is used to perform node denoising, and the Schmidt-Hilbert correlation calculation method is used to improve the adversarial robustness of graph neural networks, hinder the propagation of disturbance information, ensure that the model is insensitive to influence-maximizing attacks, and maintain the relevance of downstream tasks.
Smart Images
Figure CN120706469A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of graph machine learning security technology, and in particular to a graph adversarial defense method based on Schmidt-Hilbert correlation metric. Background Art
[0002] Artificial intelligence (AI) technology has profoundly transformed human production and daily life, and countries around the world are actively developing strategies to seize the opportunities presented by AI development. Security is a crucial foundation for the sustained and healthy development of AI technology, and within this context, AI security has garnered widespread attention. Model robustness to adversarial attacks is a key component of AI security, and ensuring the robustness of AI models is a pressing challenge, particularly in complex scenarios like graph data. Many real-world scenarios can be abstracted as graphs with vertex-edge relationships. Effectively and efficiently mining the rich information contained in graphs facilitates the application and development of data science. In recent years, graph neural networks, exemplified by message-passing mechanisms, have achieved significant success and have been successfully applied to autonomous driving, financial risk management, and drug discovery. However, like deep learning models, graph neural networks exhibit vulnerabilities. Even small, imperceptible perturbations to the data can lead to a sharp drop in model performance, severely impacting their application in downstream tasks. Therefore, exploring the mechanisms underlying their vulnerability is crucial.
[0003] Influence maximization attacks are an emerging black-box feature attack method. Attackers frame the attack as an influence maximization problem, leveraging carefully selected nodes to propagate feature perturbations widely across the graph, subsequently degrading model performance. Existing defenses are ineffective against these attacks. Even models that employ these defenses experience significant performance degradation after being subjected to influence maximization attacks, severely hindering the deployment of graph neural networks in real-world applications. These attacks are mostly global, with small perturbations significantly degrading overall model performance. Effective defenses are crucial when the perturbed nodes, perturbation intensity, and perturbation method are unknown. Furthermore, when the correlation between node embeddings and labels increases before and after perturbation, how can node representations be further constrained so that their correlation with labels is proportional to model accuracy? These are pressing issues that need to be addressed. Summary of the Invention
[0004] The purpose of this invention is to provide a graph adversarial defense method based on Schmidt-Hilbert correlation metric, which makes graph neural networks insensitive to input perturbations, thereby improving the defense capability of graph neural networks against influence maximization attacks.
[0005] To solve the above technical problems, the present invention adopts a technical solution: a graph adversarial defense method based on Schmidt-Hilbert correlation metric, comprising:
[0006] S100: System initialization module, loading the graph data extracted from reality , graph neural network classification model and hyperparameters;
[0007] S200: Node denoising module, which uses the topological structure of the graph data to determine the neighbors of each node, and denoises the central node using a parameter-free learning method. The denoised node features are used as input for the subsequent graph neural network model.
[0008] S300: The graph neural network backbone module represents the graph neural network nodes as Gaussian distributions that can eliminate data uncertainty, where each node corresponds to a Gaussian distribution;
[0009] S400: Category perception module, which calculates the correlation between denoised node attributes and the representations of each hidden layer of the graph neural network, calculates the correlation between each hidden layer representation of the graph neural network and the node category label, and constructs a Schmidt-Hilbert loss to guide the model to learn node representations with adversarial robustness;
[0010] S500: Adversarial defense verification module, the perturbation graph Input the data into the trained model to verify the model's prediction accuracy in noisy data.
[0011] Furthermore, the system initialization module loads the graph data extracted from reality , graph neural network classification model As well as the hyper parameters, the S100 is specifically as follows:
[0012] The adversarial robust graph neural network model maps node representations to Gaussian distributions. Assuming that the model has layer, then the node is in layer is expressed as:
[0013]
[0014] in Respectively represent The expected and variance learned by the layer, is a nonlinear activation function, hour The node attributes after purification , represents the degree matrix with self-loops, represents the normalized symmetric matrix, represents an adjacency matrix with self-loops, represents the identity matrix, represents the standard normal distribution.
[0015] Furthermore, the node denoising module includes a central node neighbor calculation module, a neighbor information aggregation calculation module, and a central node denoising module. The S200 includes:
[0016] S210: A central node neighbor calculation module selects a central node and obtains a neighbor set of the central node using a topological structure;
[0017] S220: A neighbor information aggregation calculation module aggregates neighbor node information in a parameter-free learning manner;
[0018] S230: A central node denoising module re-represents the central node using neighboring nodes and its own information.
[0019] Furthermore, the central node neighbor calculation module obtains neighbor information of the central node, and the S210 includes:
[0020] ,
[0021] in represents the adjacency matrix of the graph, Representation node The first-order neighbor set of For nodes neighbors.
[0022] Furthermore, the neighbor information aggregation calculation module aggregates the central node and its corresponding neighbor information in a parameter-free learning manner, and the S220 includes:
[0023]
[0024] in represents the noisy node features of the input, is the probability of transmission, represents the adjacency matrix of the graph, Indicates the neighbor order used in the denoising process.
[0025] Furthermore, the central node denoising module uses the denoised central node as the input of the model, and the S230 includes:
[0026]
[0027] in represents the node features after denoising, Indicates the Layer node representation.
[0028] Furthermore, the category perception module includes a module for calculating the correlation between denoising node attributes and each hidden layer representation, a module for calculating the correlation between each hidden layer representation and node label, and a module for calculating Schmidt-Hilbert loss. The S400 includes:
[0029] S410: A module for calculating the correlation between denoised node attributes and each hidden layer representation, unifying the denoised node attributes with the representation dimensions of each hidden layer of the graph neural network, and calculating the correlation between the denoised node attributes and the representations of each hidden layer of the graph neural network;
[0030] S420: A module for calculating the correlation between each hidden layer representation and node label unifies the dimensions of each hidden layer representation and the graph node label of the graph neural network and calculates the correlation between each hidden layer node representation and the node label;
[0031] S430: Schmidt-Hilbert loss calculation module, which constructs a loss function based on the correlation between the hidden layer representations of the graph neural network and the denoised node attributes and node labels, so as to obtain the minimum representation that can resist adversarial attacks.
[0032] Furthermore, the module S410 for calculating the correlation between the denoising node attributes and each hidden layer representation includes: a kernel function determination module, a kernel matrix calculation module, a kernel matrix centralization module and a correlation measurement module.
[0033] Furthermore, a suitable kernel function is selected according to the data characteristics, and the step S411 includes:
[0034] ,
[0035] ,
[0036] in Indicates bandwidth, After denoising, The characteristics of the nodes, represents the node feature dimension, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension.
[0037] Further, the kernel matrix is calculated, and the step S412 includes:
[0038] ,
[0039] ,
[0040] in and Represents the symmetric matrix of similarity between denoising nodes, The layer nodes represent the symmetric similarity matrix between them.
[0041] Furthermore, the kernel matrix is centrally calculated, and the step S413 includes:
[0042] ,
[0043] ,
[0044] in and Represent the node attributes after centralization and the The layer hidden represents the corresponding kernel matrix, represents the identity matrix, represents a matrix of all ones.
[0045] Furthermore, the correlation between the denoised node attributes and each hidden layer representation is measured, and the S414 includes:
[0046] ,
[0047] in Represents the node attributes after denoising and the graph neural network The correlation between the hidden representations of each layer.
[0048] Furthermore, the module S420 for calculating the correlation between each hidden layer representation and the node label includes: a kernel function module, a kernel matrix calculation module, a kernel matrix centralization module and a correlation measurement module.
[0049] Further, the kernel function to be used is determined, and the step S421 includes:
[0050] ,
[0051] ,
[0052] in Indicates bandwidth, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension, Indicates the One-hot labels for nodes.
[0053] Further, the kernel matrix is calculated, and the step S422 includes:
[0054] ,
[0055] ,
[0056] in and Respectively represent The symmetric matrix of similarity between layer hidden node representations and the symmetric matrix of similarity between node labels.
[0057] Furthermore, the core matrix is centrally calculated, and the step S423 includes:
[0058] ,
[0059] ,
[0060] in and Respectively represent the first The kernel matrix corresponding to the layer hidden representation and node label, represents the identity matrix, represents a matrix of all ones.
[0061] Furthermore, the correlation between each hidden layer representation and the node label is measured, and the S424 includes:
[0062] ,
[0063] in Representing the graph neural network The correlation between the layer hidden representation and the node label.
[0064] Furthermore, the Schmidt-Hilbert loss calculation module constructs a new loss function using correlation, and S430 includes:
[0065]
[0066] in It is a hyperparameter used to balance the correlation constraints between the hidden layer representations of the graph neural network and the denoised node attributes and node labels.
[0067] Furthermore, the attack verification module: uses the existing graph anti-attack method to perturb the graph data to obtain , and input it into the trained model to verify its performance on the perturbation data, the S500 is as follows:
[0068] ,
[0069] Accuracy is the prediction accuracy of the model. represents the indicator function, Indicates the number of nodes in the graph data, Indicates the model's response to the first The predicted labels of nodes.
[0070] The present invention provides a graph adversarial defense process based on Schmidt-Hilbert correlation metric, including system initialization module, loading graph data , initialize the Gaussian graph neural network classifier and hyperparameters; the node denoising module uses the neighbor set of the central node to purify the node attributes; the graph neural network backbone module learns a Gaussian distribution for each node ; Category perception module, calculates the hidden layer representation Respectively with the denoised node features and node labels The correlation between them is used to guide the model to learn robust node representation using Schmidt-Hilbert loss; the adversarial defense verification module transforms the perturbed graph The input is fed into the trained model to verify the adversarial defense effect of this method.
[0071] This paper provides a graph adversarial defense method based on the Schmidt-Hilbert correlation metric, comprising a module for calculating the correlation between denoised node attributes and the hidden layer representations of a graph neural network, a module for calculating the correlation between the hidden representations of each layer of the graph neural network and node labels, and a module for calculating the Schmidt-Hilbert loss. This method removes residual disturbances from graph data by weakening the correlation between denoised node attributes and the hidden layer representations of the graph neural network; and enhances the correlation between the hidden layer representations of the graph neural network and node labels to improve the relevance of each hidden layer representation with downstream tasks.
[0072] Compared with the prior art, the present invention has the following beneficial effects:
[0073] 1. When the perturbation knowledge is unknown, the neighbor information is used to denoise the central node in a parameter-free learning manner, which initially improves the adversarial robustness of the node;
[0074] 2. When the correlation between different spaces is difficult to measure, the Schmidt-Hilbert correlation calculation method is used to measure the correlation between the hidden layer representation and the denoised node features and node labels. On this basis, a Schmidt-Hilbert regularizer is constructed to enable the model to retain information related to downstream tasks while denoising, hindering the propagation of perturbation information in the graph, making the trained model insensitive to input perturbations, and thereby improving the model's robustness against influence maximization attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0075] In order to more clearly describe the technical solutions of the embodiments of the present invention, the drawings involved in the present invention will be briefly introduced below. It should be understood that the following drawings are only intended to make it easier for readers to understand the present invention and to help understanding, so they should not be regarded as limiting the scope.
[0076] Figure 1 A schematic diagram of a flow chart of a graph adversarial defense device based on Schmidt-Hilbert correlation metric provided by an embodiment of the present invention;
[0077] Figure 2 A schematic diagram of a process for denoising based on neighbor information provided by an embodiment of the present invention;
[0078] Figure 3 A schematic diagram of a category perception process based on Schmidt-Hilbert correlation measurement provided by an embodiment of the present invention;
[0079] Figure 4 A schematic diagram of the structure of a graph adversarial defense method based on Schmidt-Hilbert correlation metric provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0080] The embodiments of the present invention are described clearly and completely below with reference to the specific implementation modes involved in the accompanying drawings.
[0081] like Figure 1 、 Figure 4 As shown in Figure 2, with the development of deep learning, model adversarial robustness has made significant progress. Defense methods based on model architecture have attracted widespread attention due to their superior effectiveness and wide coverage. However, they are unable to effectively defend against emerging influence maximization attacks, which poses a security risk for the real-world application of graph neural networks. Therefore, this paper proposes a graph adversarial defense method based on the Schmidt-Hilbert correlation metric.
[0082] In one embodiment, the graph adversarial defense method based on the Schmidt-Hilbert correlation metric provided by the present invention includes: a system initialization module S100, a node denoising module S200, a graph neural network backbone module S300, a category perception module S400, and an adversarial defense verification module S500. Each module is described in detail below.
[0083] S100 system initialization module: The graph neural network model maps graph nodes to a Gaussian distribution. Each node corresponds to a Gaussian distribution representation. The representation of the node in the first layer is:
[0084]
[0085] in is a nonlinear activation function, Represents the purified node attributes , represents a normalized symmetric matrix with self-loops, represents an adjacency matrix with self-loops, represents the degree matrix, represents the identity matrix, represents the expectation and variance of the learned node representation, represents the standard normal distribution.
[0086] S200 node denoising module: To make the attack less noticeable, the perturbation imposed by the attacker is limited. The defender uses the neighbor information around the node to denoise the node, which can be formalized as:
[0087]
[0088] in represents the noisy node features of the input, is the probability of transmission, represents the neighbor order used in the denoising process, Represents the node features after denoising.
[0089] S300 graph neural network backbone module: denoising node attributes As the input of the model, and using the existing topology structure to learn Gaussian node representation for each node, the first layer node representation is:
[0090]
[0091] in is a nonlinear activation function, represents the expectation and variance corresponding to the node embedding, represents the standard normal distribution, is the node representation learned in the first layer, represents the Hadamard product. Layer nodes are represented as:
[0092]
[0093] in Represents the attention coefficient between edges in the graph data, is a hyperparameter, represents a normalized symmetric matrix with self-loops, represents an adjacency matrix with self-loops, represents the degree matrix.
[0094] S400 Category Perception Module: Utilizes the Schmidt-Hilbert correlation measurement method, which can measure different spatial variables, to construct correlation constraints between the hidden layer representations of the graph neural network and the purified node attributes and node labels. Weakening the correlation between the hidden layer representations of the graph neural network and the purified node attributes aims to remove residual disturbances in the purified node attributes; strengthening the correlation between the hidden layer representations of the graph neural network and the category labels aims to enable the model to retain the minimum sufficient information related to downstream tasks. Furthermore, the node attribute and hidden layer representation correlation calculation module S410 includes a kernel function module, a kernel matrix calculation module, a kernel matrix centralization module, and a correlation measurement module.
[0095] Furthermore, a suitable kernel function is selected according to the data characteristics, and the step S411 includes:
[0096] ,
[0097] ,
[0098] in Indicates bandwidth, After denoising, The characteristics of the nodes, represents the node feature dimension, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension.
[0099] Further, the kernel matrix is calculated, and the step S412 includes:
[0100] ,
[0101] ,
[0102] in and Represents the symmetric matrix of similarity between denoising nodes, The layer nodes represent the symmetric similarity matrix between them.
[0103] Furthermore, the kernel matrix is centrally calculated, and the step S413 includes:
[0104] ,
[0105] ,
[0106] in and Represent the node attributes after centralization and the The layer hidden represents the corresponding kernel matrix, represents the identity matrix, represents a matrix of all ones.
[0107] Furthermore, the correlation between the denoised node attributes and each hidden layer representation is measured, and the S414 includes:
[0108] ,
[0109] in Represents the node attributes after denoising and the graph neural network The correlation between the hidden representations of each layer.
[0110] Furthermore, the module S420 for calculating the correlation between each hidden layer representation and the node label includes: a kernel function module, a kernel matrix calculation module, a kernel matrix centralization module and a correlation measurement module.
[0111] Further, the kernel function to be used is determined, and the step S421 includes:
[0112] ,
[0113] ,
[0114] in Indicates bandwidth, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension, Indicates the One-hot labels for nodes.
[0115] Further, the kernel matrix is calculated, and the step S422 includes:
[0116] ,
[0117] ,
[0118] in and Respectively represent The symmetric matrix of similarity between layer hidden node representations and the symmetric matrix of similarity between node labels.
[0119] Furthermore, the core matrix is centrally calculated, and the step S423 includes:
[0120] ,
[0121] ,
[0122] in and Respectively represent the first The kernel matrix corresponding to the layer hidden representation and node label, represents the identity matrix, represents a matrix of all ones.
[0123] Furthermore, the correlation between each hidden layer representation and the node label is measured, and the S424 includes:
[0124] ,
[0125] in Representing the graph neural network The correlation between the layer hidden representation and the node label.
[0126] Furthermore, the Schmidt-Hilbert loss calculation module constructs a new loss function using correlation, and S430 includes:
[0127]
[0128] in It is a hyperparameter used to balance the correlation constraints between the hidden layer representations of the graph neural network and the denoised node attributes and node labels.
[0129] S500 Verification Module: Use existing graph adversarial methods to perturb the graph data and input it into the model trained in the above steps to verify the performance of the trained model on the perturbed data. The details are as follows:
[0130] ,
[0131] Accuracy is the prediction accuracy of the model. represents the indicator function, Indicates the number of nodes in the graph data, To use the perturbed graph data using existing methods, Indicates the model's response to the first The predicted labels of nodes.
[0132] like Figure 2 As shown, in one embodiment, the node denoising module in S200 is divided into: a central node neighbor calculation module, a neighbor information aggregation calculation module and a central node denoising calculation module.
[0133] S210: Determine the central node and extract the neighbor information of the central node, as follows:
[0134] ,
[0135] in represents the adjacency matrix, Representation node The first-order neighbor set of For nodes The label corresponding to the neighbor of .
[0136] S220: Aggregate the neighbor information corresponding to the central node in a parameter-free learning manner. The specific calculation is as follows:
[0137]
[0138] in represents the noisy node features of the input, is the probability of transmission, Indicates the neighbor order used in the denoising process.
[0139] S230: The denoised central node is used as the model input. The specific calculation is as follows:
[0140]
[0141] in Represents the node features after denoising.
[0142] like Figure 3 As shown, the S400 category perception calculation module includes: a denoising node attribute and each hidden layer representation correlation calculation module, a hidden layer representation and node label correlation calculation module, and a Schmidt-Hilbert loss calculation module.
[0143] S410: Measure the correlation between the denoised node attributes and each hidden layer representation. The calculation is divided into a kernel function determination module, a kernel matrix calculation module, a kernel matrix centralization module and a correlation measurement module.
[0144] S411: Select an appropriate kernel function based on the characteristics of the processed data, and calculate it as follows:
[0145] ,
[0146] ,
[0147] in Indicates bandwidth, After denoising, The characteristics of the nodes, represents the node feature dimension, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension.
[0148] S412: Variables in different spaces are replaced into the same space to prepare for the next step of correlation calculation. The specific calculation is as follows: ,
[0149] ,
[0150] in and Represents the symmetric matrix of similarity between denoising nodes, The layer nodes represent the symmetric similarity matrix between them.
[0151] S413: The calculated kernel matrix is centralized to remove the influence of limited feature perturbations on the correlation calculation. The calculation is as follows:
[0152] ,
[0153] ,
[0154] in and Represent the node attributes after centralization and the The layer hidden represents the corresponding kernel matrix, represents the identity matrix, represents a matrix of all ones.
[0155] S414: Calculate the correlation between the hidden layer representations of the graph neural network and the denoised node attributes:
[0156] ,
[0157] in Represents the node attributes after denoising and the graph neural network The correlation between the hidden representations of each layer.
[0158] S420: Measure the correlation between each hidden layer representation and the node label. The calculation is divided into a kernel function calculation module, a kernel matrix calculation module, a kernel matrix centralization module and a correlation measurement module.
[0159] S421: Select an appropriate kernel function based on the characteristics of the processed data. The specific calculation is as follows:
[0160] ,
[0161] ,
[0162] in Indicates bandwidth, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension, Indicates the One-hot labels for nodes.
[0163] S422: Variables in different spaces are replaced into the same space to prepare for the next step of correlation calculation. The specific calculation is as follows:
[0164] ,
[0165] ,
[0166] in and Respectively represent The symmetric matrix of similarity between layer hidden node representations and the symmetric matrix of similarity between node labels.
[0167] S423: The calculated kernel matrix is centralized to remove the influence of limited feature perturbations on the correlation calculation. The specific calculation is as follows:
[0168] ,
[0169] ,
[0170] in and Respectively represent the first The kernel matrix corresponding to the layer hidden representation and node label, represents the identity matrix, represents a matrix of all ones.
[0171] S424: Calculate the correlation between each hidden layer representation of the graph neural network and the node label. The specific calculation is as follows:
[0172] ,
[0173] in Representing the graph neural network The correlation between the layer hidden representation and the node label.
[0174] S430: Based on the correlation between each hidden layer representation obtained by the above calculation and the node attributes and node labels after denoising, a loss function is constructed. The specific calculation is as follows:
[0175]
[0176] in It is a hyperparameter used to balance the correlation constraints between the hidden layer representations of the graph neural network and the denoised node attributes and node labels.
[0177] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.
Claims
1. A graph adversarial defense method based on Schmidt-Hilbert correlation metric, characterized in that: include: S100: System initialization module, loading the graph data extracted from reality , graph neural network classification model and hyperparameters; S200: Node denoising module, which uses the topological structure of the graph data to determine the neighbors of each node, and denoises the central node using a parameter-free learning method. The denoised node features are used as input for the subsequent graph neural network model. S300: The graph neural network backbone module represents the graph neural network nodes as Gaussian distributions that can eliminate data uncertainty, where each node corresponds to a Gaussian distribution; S400: Category perception module, which calculates the correlation between denoised node attributes and the representations of each hidden layer of the graph neural network, calculates the correlation between each hidden layer representation of the graph neural network and the node category label, and constructs a Schmidt-Hilbert loss to guide the model to learn node representations with adversarial robustness; S500: Adversarial defense verification module, the perturbation graph Input the data into the trained model to verify the model's prediction accuracy in noisy data.
2. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: The system initialization of step S100 is as follows: ； in represents a nonlinear activation function, Represents the purified node attributes , represents a normalized symmetric matrix, represents an adjacency matrix with self-loops, represents the degree matrix, represents the identity matrix, denotes the expectation and variance parameters of node embeddings, represents the standard normal distribution.
3. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: The graph neural network backbone module maps the graph nodes to a Gaussian distribution, assuming that the model has layer, then the node is in layer is expressed as: ； in Respectively represent The expected and variance learned by the layer, represents a nonlinear activation function, hour Node attributes after purification , represents the degree matrix with self-loops, represents the normalized symmetric matrix, represents an adjacency matrix with self-loops, represents the identity matrix, represents the standard normal distribution.
4. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: The node denoising module includes a central node neighbor calculation module, a neighbor information aggregation calculation module, and a central node denoising module. The S200 includes: S210: A central node neighbor calculation module selects a central node and obtains a neighbor set of the central node using a topological structure; S220: A neighbor information aggregation calculation module aggregates neighbor node information in a parameter-free learning manner; S230: A central node denoising module re-represents the central node using normalized information of its neighboring nodes and itself.
5. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: The category perception module includes a denoising node attribute and each hidden layer representation correlation calculation module, a hidden layer representation and node label correlation calculation module, and a Schmidt-Hilbert loss calculation module. The S400 includes: S410: A module for calculating the correlation between denoised node attributes and each hidden layer representation, unifying the denoised node attributes with the representation dimensions of each hidden layer of the graph neural network, and calculating the correlation between the denoised node attributes and the representations of each hidden layer of the graph neural network; S420: A module for calculating the correlation between each hidden layer representation and node label unifies the dimensions of each hidden layer representation and the graph node label of the graph neural network and calculates the correlation between each hidden layer node representation and the node label; S430: Schmidt-Hilbert loss calculation module, which constructs a loss function based on the correlation between the hidden layer representations of the graph neural network and the denoised node attributes and node labels, so as to obtain the minimum representation that can resist adversarial attacks.
6. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: include: The module for calculating the correlation between the denoised node attributes and each hidden layer representation in step S410 in the category perception module includes: a kernel function determination module, a kernel matrix calculation module, a kernel matrix centering module, and a correlation measurement module. The calculation is as follows: ， ， in Indicates bandwidth, After denoising, The characteristics of the nodes, represents the node feature dimension, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension; ， ， in and Represents the symmetric matrix of similarity between denoising nodes, Symmetric matrix of similarity between node representations in a layer; ， ， in and Represent the node attributes after centralization and the The layer hidden represents the corresponding kernel matrix, represents the identity matrix, represents a matrix of all 1s; ， in Represents the node attributes after denoising and the graph neural network Correlations between hidden representations of different layers.
7. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: include: The module for calculating the correlation between each hidden layer representation and the node label in step S420 in the category perception module includes: a kernel function determination module, a kernel matrix calculation module, a kernel matrix centering module, and a correlation measurement module. The specific calculation is as follows: ， ， in Indicates bandwidth, Indicates the The node in The layer representation, Representing the graph neural network A single node in a layer represents a dimension, Indicates the One-hot labels for nodes; ， ， in and Respectively represent The symmetric matrix of similarity between node representations and the symmetric matrix of similarity between node labels of the layer; ， ， in and Respectively represent the first The kernel matrix corresponding to the layer hidden representation and node label, represents the identity matrix, represents a matrix of all 1s; ， in Representing the graph neural network The correlation between layer representations and node labels.
8. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: include: The Schmidt-Hilbert loss calculation module in step S430 in the category perception module is calculated as follows: ； in It is a hyperparameter used to balance the correlation constraints between the hidden layer representations of the graph neural network and the denoised node attributes and node labels.
9. The graph adversarial defense method based on Schmidt-Hilbert correlation metric according to claim 1, characterized in that: The attack verification module of step S500: uses the existing graph anti-attack method to perturb the graph data to obtain , and input it into the model trained in the above steps to verify the performance of the trained model on the perturbation data, as follows: ， Accuracy is the prediction accuracy of the model. represents the indicator function, Indicates the number of nodes in the graph data, Indicates the model's response to the first The predicted labels of nodes.