Graph neural network defense method based on attribute enhanced PPR and pellet clustering

Abstract

The invention belongs to the field of artificial intelligence, and particularly relates to a graph neural network defense method based on attribute enhanced PPR and pellet clustering, which comprises the following steps: in constructed graph data, nodes stay or walk to neighbors at a certain probability and execute topology or attribute migration at a certain probability during walk; comprehensively calculating an attribute enhancement similarity score of each pair of nodes by simultaneously carrying out multi-hop topology and attribute propagation; cutting the graph according to the similarity score between the nodes in the enhanced graph data, and removing or reducing the weights of the edges with insufficient similarity and abnormal edges to obtain a reconstructed graph; performing particle ball clustering on the reconstructed graph, generating super nodes and super edges, summarizing features and labels of the super nodes to form coarsening representation, and constructing a coarsening graph as a parallel coarsening training path according to the coarsening representation; and respectively carrying out forward calculation on the original image data and the coarsened image to obtain respective loss, combining the two paths of loss to reversely update the model, and carrying out iterative training to obtain a robust-resistant graph neural network. According to the invention, the robustness of the model in a hybrid confrontation scene is significantly improved.

Description

Technical Field

[0001] This invention belongs to the fields of artificial intelligence, natural language processing, and affective computing, and specifically relates to a graph neural network defense method based on attribute enhancement per prism (PPR) and granular clustering. Background Technology

[0002] Graph Neural Networks (GNNs) have demonstrated significant application potential in multiple fields, including social network analysis, recommender systems, and bioengineering. However, GNNs suffer from serious vulnerabilities: even subtle adversarial perturbations to node features or graph topology can significantly degrade model performance, posing substantial risks to practical deployments. Existing research has explored methods to resist graph adversarial attacks from various perspectives. For example, GNNGuard achieves topology refinement by learning lower attention weights for suspicious neighbors; GCN-Jaccard, on the other hand, prunes low-similarity edges based on feature similarity thresholds to mitigate the impact of potential adversarial edges.

[0003] However, most existing defenses tend to focus only on a single, isolated aspect of the perturbation (such as edge-based or node-based attacks), lacking adaptability to hybrid attacks. Achieving defense against hybrid attacks is no easy task, facing two main challenges. First, accurate node proximity assessment. The proximity between nodes directly determines whether their connecting edges will be pruned. Hybrid attacks manipulate both edges and nodes, and assessment methods must take this into account. However, most existing methods only utilize graph topology or node attributes to calculate node proximity, which is unsuitable for hybrid attacks. Second, high-fidelity graph clustering. The fidelity of graph clustering determines whether samples within a sphere are similar, i.e., the accuracy of the cluster's tolerance to perturbations. Existing graph clustering methods require pre-setting the cluster size or number, lacking flexibility and making accurate clustering difficult. Summary of the Invention

[0004] To address the problem that existing methods focus only on single types of perturbations (such as targeting only edges or only node features) and lack unified modeling and collaborative defense against hybrid attacks, this invention proposes a graph neural network adversarial defense method based on Attribute Augmentation Propagation (PPR) and Particle-Sphere Clustering. This method constructs graph data using entities in the internet as nodes and interactions between entities as edge relationships. It then uses a graph neural network to predict whether a potential edge relationship exists between two nodes, recommends nodes with potential edge relationships to the user, and trains an adversarially robust graph neural network. The specific steps include:

[0005] In the constructed graph data, nodes have a certain probability of staying or moving to their neighbors and perform topology or attribute migration with a certain probability during the movement. The attribute enhancement similarity score of each pair of nodes is calculated by simultaneously performing multi-hop topology and attribute propagation.

[0006] The graph is cropped based on the similarity scores between nodes in the enhanced graph data, and the weights of insufficient similarity and abnormal edges are removed or reduced to obtain the reconstructed graph.

[0007] Particle-sphere clustering is performed on the reconstructed graph to generate supernodes and superedges. The features and labels of the supernodes are summarized to form a coarse representation, and a coarse graph is constructed based on this as a parallel coarse-grained training path.

[0008] The loss is calculated forward on both the original graph data and the coarsened graph. The two losses are then combined to update the model in reverse. Iterative training is performed to obtain an adversarially robust graph neural network.

[0009] Compared with the prior art, the present invention has the following beneficial effects:

[0010] 1. A graph neural network adversarial defense model based on attribute augmentation pruning (PPR) and granular clustering is proposed. This model uses a two-stage collaborative approach of "attribute augmentation pruning + granular graph coarsening" to simultaneously identify and weaken malicious edges and contaminated nodes, enabling unified defense in mixed attack scenarios and significantly improving the overall robustness of the graph neural network.

[0011] 2. This invention employs a purity-driven adaptive particle splitting mechanism, which can automatically generate supernodes of arbitrary size with labels that are as consistent as possible. This preserves the semantics of the graph structure and eliminates local adversarial noise during the aggregation process.

[0012] 3. This invention applies cross-entropy loss to both the original graph and the coarsened graph, forming a dual supervision of "fine-grained node signals + coarse-grained stable structure", and is insensitive to changes in core hyperparameters. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the graph neural network adversarial defense method based on attribute enhancement PPR and particle clustering according to the present invention.

[0014] Figure 2 This is a schematic diagram of the model structure of a graph neural network adversarial defense method based on attribute enhancement PPR and particle clustering according to the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] This invention proposes a graph neural network adversarial defense method based on attribute-enhanced performance (PPR) and particle-sphere clustering. It constructs graph data using entities in the internet as nodes and interactions between entities as edge relationships. The graph neural network predicts whether a potential edge relationship exists between two nodes and recommends nodes with potential edge relationships to the user. Figure 1 Training an adversarially robust graph neural network specifically includes the following steps:

[0017] In the constructed graph data, nodes have a certain probability of staying or moving to their neighbors and perform topology or attribute migration with a certain probability during the movement. The attribute enhancement similarity score of each pair of nodes is calculated by simultaneously performing multi-hop topology and attribute propagation.

[0018] The graph is pruned based on the similarity scores between nodes in the enhanced graph data, removing or reducing the weights of insufficient similarity and abnormal edges to obtain a reconstructed graph. Abnormal edges refer to edges that have been added, deleted, or whose attributes have been changed. In this invention, the purpose of training the graph neural network is to reduce the connection weights of these abnormal edges or nodes, so that these abnormal edges or nodes can be removed through pruning.

[0019] Particle-sphere clustering is performed on the reconstructed graph to generate supernodes and superedges. The features and labels of the supernodes are summarized to form a coarse representation, and a coarse graph is constructed based on this as a parallel coarse-grained training path.

[0020] The loss is calculated forward on both the original graph data and the coarsened graph. The two losses are then combined to update the model in reverse. Iterative training is performed to obtain an adversarially robust graph neural network.

[0021] This invention applies to link prediction tasks on graph data. The method uses a defense-optimized graph neural network model to predict the probability of potential edges between any two nodes, thereby improving the robustness and accuracy of predictions under various adversarial attack scenarios. Typical applications include social networks and e-commerce platforms. In social networks, users are treated as nodes, and actions such as likes, shares, and comments are treated as edges. The prediction results are used to push friends or content to users who are "likely to establish a relationship," achieving precise social recommendations. In e-commerce platforms, users, products, and stores are all treated as nodes. By predicting potential edges, products or stores with a "high probability of interaction" are proactively pushed to users, significantly improving the conversion rate and sales rate of advertising and promotional activities.

[0022] In this embodiment, a graph is given. ,in It includes A set of nodes, It includes The set of edges, This represents the node feature matrix, where each node has F attributes. Adjacency matrix. It encodes the connectivity relationships in the graph. Adversarial attackers can manipulate the graph during model training or inference. To tamper with This includes modifying node attributes. Graph Structure Attackers can exploit perturbation rates. Controlling the attack intensity determines the proportion of edges and node attributes that are modified. (Adversarial graph) It could mislead the graph GNN during training or prediction. At the same time, the adversarial perturbation would be small enough to be imperceptible to humans.

[0023] like Figure 2 This invention mainly comprises two parts: the first part is perturbation pruning based on attribute-enhanced PPR; the second part is perturbation tolerance by granular-ball graphs. This embodiment proposes a graph neural network adversarial defense method based on attribute-enhanced PPR and granular-ball clustering, including the following steps:

[0024] Step 1: The adjacency relationships and node attributes of the initial graph are converted into multi-hop propagation probabilities based on topology and attributes, respectively. Nodes stay or move to their neighbors with a certain probability and perform topology or attribute migration with a certain probability during the move. The attribute-enhanced similarity score of each pair of nodes is calculated by simultaneously performing multi-hop topology and attribute propagation.

[0025] Step 2: Prune the graph based on the similarity score enhanced by attributes, remove or reduce the weight of edges with insufficient similarity and abnormal edges, so as to eliminate tampered connections and obtain a sparse and cleaned reconstructed graph.

[0026] Step 3: Perform granular clustering on the reconstructed graph to generate supernodes and superedges. Summarize the features and labels of the supernodes to form a coarse representation, and construct a coarse graph based on this representation as a parallel coarse-grained training path.

[0027] Step 4: Calculate the loss on the original image and the coarsened image respectively, and merge the two losses to update the model in reverse. Iterate and train to obtain an adversarial robust graph neural network.

[0028] In step 1, to utilize both node structure and node attributes in link prediction while defending against various hybrid attacks, this embodiment proposes an attribute-enhanced random walk. This approach combines topological information with attributes to obtain a node pair similarity score. This score is then used to modify the original graph data. For example, if there is an edge between nodes A and B in the original graph, the similarity score between the two nodes is calculated. If the score is greater than a set threshold, the edge can be increased or retained; otherwise, its weight can be deleted or decreased. The specific calculation of the node pair similarity score is described below:

[0029] Given a graph Where V is the set of nodes and E is the set of edges. The attribute vectors of nodes, such as user ID, gender, age, occupation, and interests, are classified into multi-dimensional descriptions of identity features, basic features, and behavioral features. The attribute-enhanced random walk is controlled by two hyperparameters: the probability of stopping and restarting. 1. Controlling the locality of the walk; 2. Attribute branch probability. : Control the weights at each step, whether to transfer based on attribute similarity or topological structure.

[0030] For any node The transfer rules are as follows:

[0031] 1.1 Based on probability Stop (or restart);

[0032] 1.2 Based on probability To jump to a node, the method consists of two parts:

[0033] 1.2.1 Based on probability Probability by attribute Transfer;

[0034] 1.2.2 Based on probability By topological probability Transfer;

[0035] Attribute Probability With topological probability It can be constructed using different strategies; common options include:

[0036] 1) Attribute similarity: Use the dot product or cosine similarity of node attributes and normalize it:

[0037]

[0038] in, Cosine similarity or other non-negative similarity can be used; if the attributes are already non-negative and the dot product is sufficiently stable, the dot product can also be used directly and normalized.

[0039]

[0040] 2) Topology transition probability: based on adjacency matrix Row normalization (equal probability neighbor selection):

[0041]

[0042] Alternatively, more complex topology transition rules, such as weighted edge / degree correction, can be introduced.

[0043] Therefore, in this embodiment, we can obtain the wanderer's starting point from the node. arrive Fusion transition probability Represented as If node Reaching the node after L jumps Then the similarity score of the node pairs in the link. Represented as:

[0044]

[0045] in, It can be further used as a training feature to improve the link prediction performance in scenarios with attribute information; This represents the number of steps taken in a random walk. This represents the attribute probability of the l-th step walk; This represents the topological probability of the l-th walk. These attributes can be categorized into multi-dimensional data such as identity information, basic information, and behavioral characteristics, used to describe the personalized characteristics of nodes. Increase Strengthening the influence of attribute information on link prediction is advantageous when the attribute information is reliable. Increase This makes the scoring more local and emphasizes the nearest neighbor structure, making it suitable for local edge prediction.

[0046] In step 2, based on similarity scores This invention proposes a soft pruning mechanism to attenuate the influence of adversarial edges while preserving necessary structural information. Instead of deterministically deleting connections with the lowest similarity, this invention performs soft pruning on each edge... Assign it equal to its similarity score The weights are determined, and edges with low scores are randomly pruned.

[0047] Specifically, set This represents the lowest 20% of the similarity scores. The adjacency matrix entries are updated as follows:

[0048]

[0049] in, This is an indicator function. The similarity is lower than... The edge weights are reduced to zero, while the remaining edges are assigned continuous weights equal to their similarity scores. This soft pruning strategy retains 80% of the edges in the expected manner, smoothly reduces the propagation of noise from adversarial perturbations, and maintains graph connectivity by preserving weighted edges rather than performing hard deletions.

[0050] In step 3, this embodiment focuses on the link prediction task. Step 3 uses the reconstructed and cleaned graph obtained in step 2 (denoted as...). ,in Particle-sphere clustering is performed on the edge set after soft pruning / attribute enhancement similarity filtering. Atomic nodes are aggregated into supernodes (particles), and superedges are constructed based on the connections at the atomic level, thereby forming a coarsened graph. The coarsened graph is used as a parallel coarse-grained training path, specifically designed to improve the resilience of link prediction to adversarial disturbances and the efficiency of candidate edge retrieval. The specific implementation of step 3 is explained below:

[0051] According to the embodiments, degree centrality, feature clustering (such as k-means), or random sampling can be used to determine [the appropriate method / method]. Initial central nodes The preferred implementation method is to select nodes in descending order of degree. Each node serves as the center to enhance the coverage of structural information. For each atomic node... Calculate its distance to each center The distance metric (which can be the shortest path distance in an unweighted graph, Dijkstra's distance in a weighted graph, or Euclidean / cosine distance based on feature space) and will be used to... Distributed to the nearest center corresponding sphere This yields the initial set of spheres. For each ball Calculate label purity in the labeled implementation:

[0052]

[0053] In label-free embodiments, intra-cluster similarity (e.g., node feature variance or average similarity) can be used instead of purity measures, or pseudo-labels of nodes can be predicted and purity calculated based on the pseudo-labels. Then for Split: In Select two subcenters within the cluster (e.g., select the largest and second largest intra-cluster degrees, or initialize using local k-means), and then... The middle nodes are redistributed according to their distance to the child center. Repeat purity testing and separation for each new sphere until the desired purity is achieved. Or the stopping condition is met. Clustering terminates when all spheres meet the purity requirement or reach the minimum size / maximum depth, resulting in the final sphere set. ,in Indicates granules The corresponding supernode.

[0054] To enable the coarsened graph to be directly used for link prediction, the following hyperedge definition and weight calculation method are adopted:

[0055] For the characteristics of supernodes, each supernode The features are obtained by aggregating the features of the atomic nodes they contain, preferably using the arithmetic mean or weighted mean:

[0056]

[0057] in The aggregation weights can be selected as the arithmetic mean, median, or confidence-weighted mean; in labeled scenarios, the aggregation weights can be adjusted based on the label distribution within the cluster. If the arithmetic mean is used, then:

[0058]

[0059] For the labels of supernodes This invention employs a majority voting-based strategy to determine the label of a supernode. For each supernode... The algorithm calculates the frequency of each category label in all its child nodes. Then, it normalizes these frequencies to obtain the proportion of each category label within the supernode. Finally, in this embodiment, the category label with the highest proportion is selected as the supernode. The predicted label. This process is represented as:

[0060]

[0061] in Let be the indicator function. For the existence of a hyperedge, given any pair of hypernodes... If there exists at least one original edge Make and Then, hyperedges are established in the coarsened graph. .

[0062] On the purified reconstructed graph, particle-sphere clustering based on purity constraints is implemented to generate supernodes and superedges, forming a coarsened graph that preserves semantics and topology. The coarsened graph can be used as a parallel training path to improve the robustness of the model and can improve the accuracy and stability of link prediction under various mixed adversarial perturbation scenarios.

[0063] Generally, link prediction involves inputting graph data into a graph convolutional neural network for feature extraction, and then using the extracted features to determine downstream link prediction tasks. In step 4, to achieve high accuracy and adversarial robustness in the link prediction task, this embodiment performs forward computation on the coarsened map obtained in step 3 and the reconstructed clean map obtained in step 2 to obtain the corresponding prediction scores and losses. That is, the graph convolutional network is used to aggregate the reconstructed clean map and the coarsened map, and the aggregated features are used to predict the labels of the corresponding downstream tasks. The losses from the reconstructed clean map and the coarsened map are combined for backpropagation to update the model parameters, thereby iteratively training to obtain an adversarial robust graph neural network model. The trained graph neural network is more sensitive to modified graph data, and the prediction accuracy is higher for this type of graph data. The specific implementation of step 4 is explained below:

[0064] The coarsened map is obtained from the spherical clustering in step 3. Its adjacency matrix is The label matrix is Robust training is performed on the coarsened graph to supervise link prediction for pairs of supernodes (superedges). The training objective is expressed as:

[0065]

[0066] in, The parameter is The graph convolutional neural network (GCN) model, This represents the standard multi-class cross-entropy loss. This represents the set of supernodes used as training objects in the coarsened graph. This training enhances the robustness of link prediction in three ways. First, granular sphere clustering merges nodes with similar topology and attributes into supernodes; the labels and vector representations of these coarse-grained nodes dilute the perturbations of individual nodes, focusing more on common features, thus resisting adversarial attacks. Second, training on a coarsened graph with fewer nodes and edges can be seen as an implicit regularization; the simplified graph prevents the model from overfitting to fine-grained perturbations in the original graph, allowing the model to learn more generalized patterns and global topological structures, thereby improving robustness. Third, the coarsened graph provides a high-level supplementary view to the original fine-grained perspective. To ensure atomic-level accuracy, fine-grained link supervision is performed on the reconstructed and cleaned original graph; the fine-grained loss is expressed as:

[0067]

[0068] By learning in parallel or alternately on coarse and fine graphs, the model acquires robust priors at the coarse level while retaining atomic-level discriminative ability, thus enabling it to identify stable structural and attribute information even on attacked training graphs. Finally, the two loss paths are combined into a total loss. And minimize it, as shown below:

[0069]

[0070] In practice, coarsened graphs can be used to pre-screen high-confidence superedges and map them to an atomic-level candidate set, thereby limiting the range of fine-grained scoring, reducing computational overhead, and reducing noise propagation. Training strategies can include parallel joint training, alternating training, or pre-training with coarsening followed by fine-grained fine-tuning.

[0071] Based on the above four stages, this embodiment proposes a graph neural network adversarial defense method based on attribute enhancement PPR and particle-sphere clustering, as shown in Algorithm 1, which specifically includes:

[0072] In each training round In this process, iterative calculations are performed layer by layer on all layers of the graph neural network;

[0073] compute nodes Its neighboring nodes The similarity score is calculated by considering both the graph's topological structure and attribute features. According to the calculation formula, in this embodiment, the similarity score is... As an important evaluation indicator, if this value is greater than the set threshold, there is no need to prune nodes in the early stage. In the later stage, when predicting the relationship between nodes, the robustness can be improved.

[0074] Subsequently, based on In this embodiment, edges with low similarity are pruned proportionally to obtain the pruned adjacency matrix. ;

[0075] Next, granular-spherical clustering is performed on the pruned graph to construct a coarsened graph containing the average features of the supernodes. and majority voting tags Then, the features and labels of the original nodes are replaced with the features and labels of the supernodes.

[0076] Subsequently, forward propagation is performed on the original graph and the loss is calculated. Perform forward propagation on the coarse map and calculate the loss. The total loss of the design model is The learnable weight matrix is ​​updated via backpropagation and gradient descent. ;

[0077] After multiple rounds of training, the final weight matrix is ​​used. Perform forward propagation on the original image to obtain the final predicted label. .

[0078] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A graph neural network defense method based on attribute-enhanced PPR and granular ball clustering, which constructs a graph data with entities in the Internet as nodes and interactions between entities as edge relationships, predicts whether there is a potential edge relationship between two nodes using a graph neural network, and recommends nodes with potential edge relationships to users, characterized in that, The training of the adversarially robust graph neural network specifically comprises the following steps: In the constructed graph data, nodes stay or walk to neighbors with a certain probability and perform topology or attribute migration in the walk with a certain probability, and the attribute-enhanced similarity scores between each pair of nodes are calculated by simultaneously performing multi-hop topology and attribute propagation; The graph is pruned according to the similarity scores between nodes in the enhanced graph data to obtain a reconstructed graph; The graph is pruned according to the similarity scores between nodes in the enhanced graph data to obtain a reconstructed graph; The graph is pruned according to the similarity scores between nodes in the enhanced graph data to obtain a reconstructed graph; 2. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 1, characterized in that, The graph is pruned according to the similarity scores between nodes in the enhanced graph data to obtain a reconstructed graph. The node stops performing the hop with a probability of p and performs the hop once with a probability of 1-p. The node performs a hop with a probability Performing attribute transfer, or with a probability Performing topology transfer.

3. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 2, characterized in that, If node with probability to node , the walker chooses the next node with attribute probability , the walker chooses the next node with attribute probability ​ When performing a topology shift, the row normalization is performed on the adjacency matrix, and the walker takes the normalized value as the topology probability Selecting the next node.

4. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 2, characterized in that, The process that nodes stay or walk to neighbors with a certain probability and perform topology or attribute migration in the walk with a certain probability comprises: wherein, represents a similarity score between a node and a node in the enhanced graph data; represents a number of steps of a random walk; represents a property probability of the lth step walk; represents a topological probability of the lth step walk.

5. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 1, characterized in that, The similarity scores between nodes in the enhanced graph data are expressed as: performing granulocyte clustering on the nodes to obtain a granulocyte set composed of M granulocytes wherein representing a granulocyte corresponding supernodes, each supernode being composed of a plurality of nodes; The process of constructing the coarse graph comprises: For supernode and supernode , if any one of the nodes belonging to supernode has an edge relationship with any one of the nodes belonging to supernode in the reconstructed graph, supernode and supernode have a superedge.

6. The defense method of claim 5, wherein, The attribute of each super node is the average value of each feature in the attributes of the nodes in the structure constituting the super node; 7. The defense method of claim 5, wherein, For nodes with labels, when the attribute of the super node is calculated by weighted average, the proportion of the label carried by the node in the proportion of all node labels in the grain ball is weighted, and the greater the proportion of the label carried, the greater the weight. Select by node degree from largest to smallest. Each node is used as the initial center of the grain, and each node is assigned to the grain corresponding to the nearest grain center. The process of performing grain ball clustering on nodes comprises: The purity of each grain ball is calculated, and if the purity is less than the set minimum purity value, the two nodes with the highest degree in the grain ball are selected as new grain balls, and splitting is performed until the grain ball reaches the set minimum size, maximum depth or purity meets the condition; 8. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 1, 5 or 7, characterized in that, The proportion of the label with the highest frequency in the grain ball in all labels in the grain ball is taken as the purity. wherein, is a loss function for robust training on the coarse graph; denotes a set of hypernodes as training objects in the coarse graph denotes the number of hypernodes in the set of hypernodes denotes a cross-entropy between and denotes a label of a hypernode predicted by a graph neural network with parameters from input hypernode features and an adjacency matrix between hypernodes denotes a true label of the hypernode.​​​ 9. The defense method of the graph neural network based on attribute-enhanced PPR and granular ball clustering according to claim 1, characterized in that, The loss function for robust training of the graph neural network on the coarse graph during training is expressed as: The loss function for robust training of the graph neural network on the original graph data during training is expressed as: The loss function for robust training of the graph neural network on the coarse graph during training is expressed as: wherein, is a loss function for robust training on original graph data; denotes a number of nodes in a node set as a training object in original graph data denotes a number of nodes in a node set as a training object in original graph data denotes a cross-entropy between and denotes a label of a node v predicted by a graph neural network with parameters from an input node feature , an adjacency matrix between nodes denotes a true label of a node.​​

Images