Graph convolutional network confrontation defense method based on adaptive frequency spectrum filtering

Abstract

The invention discloses a graph convolutional network confrontation defense method based on adaptive frequency spectrum filtering. Firstly, spectral analysis is performed on a graph structure, and spectral distribution of graph data is obtained and evaluated; then, an adaptive spectrum filter is constructed based on the distribution, and the filter can automatically adjust parameters according to the degree distribution and the maximum characteristic value of the graph, so that the most robust spectrum interval under the attack resistance is adaptively determined; on the basis, invalid or harmful frequency spectrum components introduced by disturbance are weakened by a filter and are embedded into the propagation process of the graph convolutional network, and finally, the resistance of the model to confrontation disturbance is improved at the frequency domain level, and a stable prediction result is output. According to the method, negative effects caused by disturbance can be inhibited without adding additional filtering plug-ins, so that the node classification precision and the stability of the model in an adversarial environment are improved.

Description

Technical Field

[0001] This invention belongs to the field of graph adversarial defense, specifically a graph convolutional network adversarial defense method based on adaptive spectral filtering. Background Technology

[0002] Graph-structured data can effectively represent real-world data and their relationships, and therefore has been widely used in many fields, including social networks, biological networks, and transportation networks. In recent years, graph neural networks (GNNs), especially graph convolutional networks (GCNs), have shown outstanding performance in processing graph-structured data and have been widely used in tasks such as node classification, link prediction, community detection, and recommender systems.

[0003] With the increasing adoption of graph neural networks (GCNs) across various fields, the problem of graph adversarial attacks has garnered significant attention from researchers. Like traditional neural networks, GCNs are vulnerable to adversarial attacks. Attackers can often significantly reduce the model's performance in tasks such as node classification and link prediction simply by making minor perturbations to the graph structure or node features. This phenomenon not only threatens the security of the model's practical applications but also limits its further application in critical scenarios. As research into graph adversarial problems deepens and various excellent graph adversarial attack methods emerge, the requirements for graph adversarial defense methods are constantly increasing. These requirements include a greater need for robustness improvements, adaptability to different types of attacks, efficiency in large-scale graph computation, and scalability and generality of the model.

[0004] In recent years, an increasing number of defense methods have focused on resisting stronger attacks and improving generalization ability across datasets. Existing methods such as graph sanitization, graph structure learning, and graph authentication mechanisms have improved model stability to some extent, but most of these methods rely on additional plugins to identify and filter adversarial attacks rather than enhancing the robustness of the model itself. This makes them increasingly ineffective in dealing with multiple attacks or complex combinations of attacks, hindering further breakthroughs. Researchers have begun to turn their attention to the frequency domain, focusing on the perturbation characteristics of graph signals in the frequency domain, and proposing to enhance robustness through spectral filtering. This type of method presents a new perspective on resisting adversarial attacks and can effectively suppress the interference of adversarial attacks. Among these methods, the mid-frequency filtering method (Mid-GCN) has achieved good results in various aspects.

[0005] Mid-GCN (Mid-Pass Filtering Graph Convolutional Networks) introduces an intermediate-frequency filter into the graph convolutional network, focusing on extracting the more stable mid-frequency range of the Laplacian spectrum under adversarial attacks, thereby reducing the impact of low-frequency over-smoothing and high-frequency noise. This method improves robustness under various attack scenarios, but due to its fixed filter shape, it requires additional expert knowledge for adjustment and lacks flexibility in frequency band extraction. Summary of the Invention

[0006] The technical problem this invention aims to solve is enhancing the model's defense against adversarial attacks without using additional detection and filtering plugins. This invention proposes a novel adversarial defense method for graph convolutional networks based on adaptive spectral filtering (ASF-GCN). After testing, this method significantly improves the ability of graph convolutional networks to defend against different adversarial attacks and attack intensities, without requiring additional expert knowledge.

[0007] The technical solution adopted in this invention is as follows: First, spectral analysis is performed on the graph structure to obtain and evaluate the spectral distribution of the graph data; then, an adaptive spectral filter is constructed based on this distribution. This filter can automatically adjust its parameters according to the degree distribution and the maximum eigenvalue of the graph, thereby adaptively determining the most robust spectral range under adversarial attacks; on this basis, the filter is used to weaken the invalid or harmful spectral components introduced by the perturbation and embed them into the propagation process of the graph convolutional network, ultimately improving the model's resistance to adversarial perturbations at the frequency domain level and outputting stable prediction results. This method is implemented through the following steps:

[0008] Step 1: Represent the original graph dataset as a set of nodes, a set of edges, and a node feature matrix, and divide it into a training set, a validation set, and a test set according to a set ratio.

[0009] Step 2: Input Data Preprocessing

[0010] An adjacency matrix is ​​constructed based on the edge set of the input data, and self-loops are added to it to obtain a self-loop enhanced adjacency matrix. The degree matrix is ​​then calculated, and a normalized adjacency matrix is ​​obtained based on the self-loop enhanced adjacency matrix and the degree matrix to improve the numerical stability of graph convolution propagation. A normalized Laplacian matrix is ​​further constructed using the normalized adjacency matrix. Simultaneously, the node feature matrix of the input data is column-normalized to ensure consistent feature scale across dimensions, resulting in a standardized feature matrix.

[0011] Step 3: Approximate the largest eigenvalue of the normalized Laplacian matrix using the power iteration method. This method requires only one sparse matrix-vector multiplication per iteration, making it suitable for efficient approximation calculations of large-scale graphs.

[0012] Step 4: Calculate the degree distribution vector of the graph using the obtained normalized adjacency matrix.

[0013] Calculate the degree value of each node in the input data node set and normalize it. Then, divide the interval [0,1] into a fixed number of equal-width sub-intervals and count the proportion of nodes in each interval. Finally, arrange these proportions in interval order to form a fixed-length degree distribution vector to characterize the overall connectivity of the graph.

[0014] Step 5: Based on the obtained maximum eigenvalue and degree distribution vector, generate weight and bias vectors through two independent MLPs with ReLU activation. Then, combine the three basic quadratic filtering functions as basis functions to integrate the weights and biases to obtain the final adaptive spectral filtering function.

[0015] Step 6: After constructing the adaptive spectral filtering function, perform eigenvalue decomposition on the normalized Laplacian matrix to obtain the eigenvalue matrix. Then, scale normalize the eigenvalue matrix based on the largest eigenvalue to ensure it falls within a predefined range. Finally, project the normalized eigenvalue matrix into the spectral domain, perform weighted modulation on each frequency component according to the adaptive spectral filtering function, and then perform an inverse transform back to the node domain to obtain the filtered node feature representation.

[0016] Step 7: Perform graph convolution propagation on the node feature representations to obtain node prediction results. To prevent overfitting and improve training stability, layer normalization and dropout are added to each layer of the graph convolution.

[0017] Step 8: Based on the preprocessed training set data, optimize the model parameters through supervised training. In each training round, the node prediction results are compared with the training labels, and the prediction error is measured using cross-entropy loss. Backpropagation is then used to propagate the error to the parameters of each layer. The model parameters are updated based on gradients using an adaptive optimization algorithm. During training, the model performance is monitored using a validation set, and early stopping and hyperparameter adjustments are determined based on the validation loss until training converges, ultimately yielding the trained model.

[0018] Step 9: After training and optimization are completed, evaluate the performance on the test set using the optimal model parameters.

[0019] The testing phase uses a more intuitive classification accuracy to evaluate performance. In addition, to assess the robustness of the model, the model is tested under different attack intensities or types, and its performance difference on clean graphs and adversarial graphs is compared to verify the anti-disturbance capability of adaptive spectral filtering.

[0020] The beneficial effects of this invention are as follows:

[0021] This invention employs an adaptive spectral filtering method to dynamically capture spectral information within a graph structure. Through learnable filter parameter optimization, it effectively enhances the model's ability to extract robust topological features during spectral signal transmission. It can suppress the negative impact of perturbations without adding additional filtering plugins, thereby improving node classification accuracy and model stability in adversarial environments.

[0022] To address the issue of graph neural networks being vulnerable to adversarial attacks and experiencing a sharp performance decline during applications, this invention employs an adaptive spectral filtering method to enhance the model's ability to extract robust topological features. Without adding additional filtering plugins or expert knowledge, this significantly improves the graph convolutional model's inherent defense against adversarial attacks. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the overall structure of an embodiment of the present invention.

[0024] Figure 2 This is a detailed structural diagram of an embodiment of the present invention.

[0025] Figure 3 This is a comparison of the accuracy (ACC) of the embodiments of the present invention with eleven existing methods on five public datasets. Detailed Implementation

[0026] The present invention will be further described below with reference to the accompanying drawings and specific implementation steps:

[0027] An adversarial defense method for graph convolutional networks based on adaptive spectral filtering (ASF-GCN) includes the following steps:

[0028] Step 1: Given the original graph dataset, represent it as a graph. ,in It is a set of nodes, each node corresponding to a basic entity in the graph (such as a user, item, or sample node). This is a set of edges used to describe the structural relationships between nodes; Let be the node feature matrix, where the _i_th ... Rows represent nodes The feature vectors are then divided into training, validation, and test sets according to a set ratio. For example, in commonly used Cora, Citeseer, and PubMed datasets, a fixed number of nodes are usually selected from each class of nodes as training samples, and the remaining parts are used as validation and test sets respectively, with a ratio of 1:1:8.

[0029] Step 2: Input Data Preprocessing

[0030] Based on the edge set of the input data Construct the corresponding adjacency matrix Among them, if node With nodes If there is an edge connecting them, then let ,otherwise The adjacency matrix is ​​then standardized: in the original adjacency matrix... Adding self-loops to the diagonal results in a self-loop enhanced adjacency matrix. And further calculate its degree matrix. The normalized adjacency matrix is ​​obtained. This ensures the numerical stability of the graph convolution propagation process. Furthermore, based on the obtained normalized adjacency matrix... Construct the normalized Laplace matrix Meanwhile, to avoid numerical imbalance between features of different dimensions, the node feature matrix of the input data is... Normalize by column to obtain the standardized feature matrix This ensures that all feature dimensions have the same scale.

[0031] like Figure 1 The overall structure of the present invention is shown in the figure.

[0032] Step 3: Calculate the normalized Laplacian matrix Maximum eigenvalue To avoid the high computational cost of performing complete feature decomposition on large-scale graphs, this invention employs a power-law iteration method. The method approximates the solution by finding the largest eigenvalue. The main overhead of each iteration is a single sparse matrix-vector multiplication, with a time complexity of approximately [time complexity missing]. ( (where is the number of edges in the graph), and the memory overhead is storing the sparse matrix and one or more elements of length . ( It is a vector representing the number of nodes in the graph, and is therefore suitable for approximate calculations of large-scale graph data.

[0033] The specific solution steps are as follows:

[0034] (1) Initialization: Randomly initialize a non-zero vector. (For example, each component is taken as an independent standard normal random number), and it is normalized to the unit norm as an approximate eigenvector. .

[0035] (2) Iteration: In the kth iteration, the intermediate vector is calculated first. Then, norm normalization is performed on the intermediate vector to obtain a new approximate eigenvector. The Rayleigh quotient is calculated using this approximate eigenvector as an estimate of the current largest eigenvalue: .

[0036] (3) Convergence: When the relative difference of the estimated values Less than the preset threshold (e.g., 10) −6 (or reaching the maximum number of iterations) The iteration terminates at time, and with As the required maximum eigenvalue.

[0037] Step 4: Based on the normalized adjacency matrix Calculate the degree distribution vector of the graph. The specific operations are as follows: (1) Traverse the normalized adjacency matrix This yields the degree value of each node. ,

[0038]

[0039] in, Represents a node The degree value.

[0040] Then, normalization is performed, which involves dividing the original degree of the node by the maximum degree in the graph. The normalization value is obtained between 0 and 1. :

[0041]

[0042] (2) In the interval Pre-divide the upper region into a fixed number of sub-intervals (e.g., 10 equal-width intervals):

[0043]

[0044] in, Indicates the first Sub-intervals, This represents the total number of subintervals. Indicates the index of the subinterval.

[0045] Map the normalized value of each node to the corresponding interval, and count the proportion of nodes falling into each interval out of the total number of nodes:

[0046]

[0047] in, Indicates the first Sub-intervals The corresponding node ratio.

[0048] (3) Finally, these proportions are arranged in interval order to form a degree distribution vector of fixed length. This degree distribution vector can stably reflect the overall connectivity characteristics of the graph structure:

[0049]

[0050] Step 5: Obtain the largest eigenvalue and the degree distribution vector generated in step 3 Next, an adaptive spectral filtering function is constructed and its parameterized form is given. The specific steps are as follows:

[0051] (1) Introduce three types of basic quadratic filtering functions as basis functions:

[0052]

[0053]

[0054]

[0055] in, , , These represent the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively. Represents the normalized graph Laplace matrix eigenvalues.

[0056] (2) Degree distribution vector As input, a weight vector is generated through a two-layer MLP with ReLU activation. Specifically:

[0057]

[0058] in, It is the parameter of the first MLP. and These are the outputs of the first and second layers of the first MLP, respectively.

[0059] The output of the second layer of the first MLP is obtained through softmax. Mapped to a non-negative weight vector that sums to 1 :

[0060]

[0061] in, These represent the weights of the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively.

[0062] (3) The largest eigenvalue As input to another two-layer MLP with ReLU activation, a translation vector is generated. The format is:

[0063]

[0064]

[0065] in, It is the parameter of the second MLP. and These are the outputs of the first and second layers of the second MLP, respectively. These represent the shift amounts for the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively.

[0066] (4) Integrate the weights and biases to obtain the adaptive spectral filtering function. :

[0067]

[0068] In matrix form, the corresponding spectral function is:

[0069]

[0070] in, Represents the eigenvalues ​​in matrix form.

[0071] Step 6: After constructing the adaptive spectrum filtering function in Step 5, perform frequency domain filtering on the node features. The specific steps and formulas are as follows:

[0072] (1) Eigenvalue decomposition. For the normalized Laplace matrix... Perform eigenvalue decomposition to obtain the orthogonal eigenvector matrix. and diagonal eigenvalue matrix :

[0073]

[0074] in, Indicates the first Each feature value.

[0075] (2) Eigenvalue normalization. Based on the obtained largest eigenvalue... diagonal eigenvalue matrix The eigenvalues ​​in the graph are scale-normalized to ensure that frequency indices on graphs of different sizes can be compared and processed at the same scale.

[0076]

[0077] (3) Spectral domain filtering. Given a normalized feature matrix. Using the orthogonal eigenvector matrix As a graph Fourier basis, the normalized feature matrix is ​​subjected to a graph Fourier transform, projecting it from the nodal domain to the spectral domain:

[0078]

[0079] in, This represents the characteristic matrix in the spectral domain.

[0080] In the spectral domain, the spectral coefficients corresponding to each graphical Laplace eigenvalue, i.e., each frequency component, are sequentially filtered according to the adaptive spectral filtering function. Weighting:

[0081]

[0082] in, This represents the weighted spectral domain feature matrix.

[0083] Then, the inverse graph Fourier transform is used to transform back to the node domain, resulting in the filtered node feature matrix. :

[0084]

[0085] Step 7: Obtain the node feature matrix after adaptive spectral filtering in step 6. Then, it is used as input to a Graph Convolutional Network (GCN), the GCN's... Layered recursive propagation can be represented as:

[0086]

[0087] in For the first The learnable weight matrix of the layer, For bias vectors, This represents an element-wise nonlinear activation function. This represents the input feature matrix of the l-th layer of the GCN, where the first layer is... .

[0088] For a two-layer GCN, it can be represented as:

[0089]

[0090] in The predicted probability distribution of each node belonging to each category ( (Number of categories). If more layers are needed, continue stacking using the recursive formula described above.

[0091] To avoid overfitting and improve training stability, LayerNorm and dropout are added to each layer, i.e.:

[0092]

[0093] in This is the dropout ratio.

[0094] like Figure 2 The detailed calculation process of the present invention is shown in the figure.

[0095] Step 8: After completing the graph convolution propagation in Step 7, obtain the predicted probability distribution of each node belonging to a different category. Then, the model parameters are optimized through a supervised training process. Specifically, the classification prediction probability distribution of nodes in the training set is used. The results are compared with the true labels, and the cross-entropy loss function is used. It is used to measure the difference between model predictions and actual results. The cross-entropy loss function is defined as:

[0096]

[0097] in This represents the set of labeled nodes in the training set. This represents the predicted probability matrix output by the model. This represents the actual one-hot label matrix.

[0098] Subsequently, the backpropagation algorithm is used to propagate the error layer by layer to the model's learnable parameters, including the weights and biases of the graph convolutional layers and the parameters of the MLP required to generate the weights and translation vectors in the adaptive spectral filter function. Parameter updates are then performed based on gradient information. During optimization, adaptive optimization algorithms such as Adam are employed to adaptively adjust the learning rate for different parameter dimensions, thereby accelerating model convergence and improving the stability of the training process.

[0099] During training, the model's generalization ability is assessed by monitoring changes in the validation set loss, which in turn adjusts the hyperparameters and serves as the basis for an early stopping strategy to prevent overfitting to the training data. When the validation set loss no longer decreases over several consecutive training epochs, model parameter updates are stopped, resulting in the final trained model.

[0100] Step 9: After completing the training and optimization in Step 8, evaluate the performance of the test set using the optimal model parameters obtained from the training. Specifically, this involves analyzing the node feature matrix in the test set. The corresponding graph structure is input into the optimal model obtained in step 8. After adaptive spectral filtering and multi-layer graph convolutional propagation, the prediction probability matrix is ​​obtained. in To determine the number of nodes in the test set, This represents the total number of categories.

[0101] The same cross-entropy loss function as the training phase is used as the performance metric during the testing phase. Additionally, to intuitively reflect the model's classification performance, classification accuracy can be calculated, defined as:

[0102]

[0103] in, This is an indicator function; it takes a value of 1 when the predicted class matches the true class, and 0 otherwise.

[0104] During robustness evaluation, the model can be further applied to test graphs under different attack intensities or types to verify its stability under structural perturbations. By comparing the performance differences on clean and adversarial graphs, the effectiveness of the adaptive spectral filtering module in resisting adversarial attacks can be quantitatively evaluated.

[0105] Figure 3 The table shows the experimental results of eleven methods on five datasets (Ogbn-ArXiv is a large dataset, and its performance was only tested on clean images) under the same experimental conditions (using Metaattack as the attack method). For each experimental condition, the best-performing model is indicated in bold, and the second-best results are indicated by underlining. The table shows that the Adaptive Spectral Filtering (ASF-GCN) method significantly outperforms the other ten methods, especially on clean images that have not been attacked.

[0106] This application also provides a graph convolutional network adversarial defense system based on adaptive spectral filtering, including the following modules:

[0107] Dataset acquisition module: Represents the original graph dataset as a set of nodes, a set of edges, and a node feature matrix, and divides it into training set, validation set, and test set according to a set ratio.

[0108] Data preprocessing module:

[0109] An adjacency matrix is ​​constructed based on the edge set of the input data, and self-loops are added to it to obtain a self-loop enhanced adjacency matrix. The degree matrix is ​​then calculated, and a normalized adjacency matrix is ​​obtained based on the self-loop enhanced adjacency matrix and the degree matrix to improve the numerical stability of graph convolution propagation. A normalized Laplacian matrix is ​​further constructed using the normalized adjacency matrix. Simultaneously, the node feature matrix of the input data is column-normalized to ensure consistent feature scale across dimensions, resulting in a standardized feature matrix.

[0110] Maximum eigenvalue calculation module: The maximum eigenvalue of the normalized Laplacian matrix is ​​approximately calculated using the power iteration method.

[0111] Degree distribution vector calculation module: Calculates the degree distribution vector of the graph using the obtained normalized adjacency matrix.

[0112] Calculate the degree value of each node in the input data node set and normalize it. Then, divide the interval [0,1] into a fixed number of equal-width sub-intervals and count the proportion of nodes in each interval. Finally, arrange these proportions in interval order to form a fixed-length degree distribution vector to characterize the overall connectivity of the graph.

[0113] The adaptive spectral filtering function construction module is as follows: Based on the obtained maximum eigenvalue and degree distribution vector, weight and bias vectors are generated through two independent MLPs with ReLU activation. Then, the weights and biases are integrated together with three basic quadratic filtering functions as basis functions to obtain the final adaptive spectral filtering function.

[0114] The filtering module, after constructing the adaptive spectral filtering function, performs eigenvalue decomposition on the normalized Laplacian matrix to obtain the eigenvalue matrix. Then, it performs scale normalization on the eigenvalue matrix based on the largest eigenvalue, ensuring it falls within a predefined range. Finally, after projecting the normalized eigenvalue matrix into the spectral domain, it performs weighted modulation on each frequency component according to the adaptive spectral filtering function, and then performs an inverse transform back to the node domain, thus obtaining the filtered node feature representation.

[0115] Prediction module: The node feature representation is propagated through graph convolution to obtain the node prediction result. To prevent overfitting and improve training stability, layer normalization and dropout are added to each layer of graph convolution.

[0116] Training Module: Based on the preprocessed training set data, supervised training is used to optimize model parameters. In each training round, the node prediction results are compared with the training labels, cross-entropy loss is used to measure the prediction error, and backpropagation is used to propagate the error to the parameters of each layer. Model parameters are updated based on gradients using adaptive optimization algorithms such as Adam. During training, a validation set is used to monitor model performance, and early stopping and hyperparameter adjustments are determined based on the validation loss until training converges, ultimately yielding the trained model.

[0117] Evaluation module: After training and optimization are completed, the optimal model parameters are used to evaluate the performance on the test set.

[0118] The testing phase uses a more intuitive classification accuracy to evaluate performance. In addition, to assess the robustness of the model, the model is tested under different attack intensities or types, and its performance difference on clean graphs and adversarial graphs is compared to verify the anti-disturbance capability of adaptive spectral filtering.

[0119] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0120] The various embodiments in this specification are described in a related manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

[0121] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A graph convolutional network adversarial defense method based on adaptive spectral filtering, characterized in that, Includes the following steps: Step 1: Represent the original graph dataset as a set of nodes, a set of edges, and a node feature matrix, and divide it into a training set, a validation set, and a test set according to a set ratio; Step 2: Input Data Preprocessing An adjacency matrix is ​​constructed based on the edge set of the input data, and self-loops are added to it to obtain a self-loop enhanced adjacency matrix. Then, the degree matrix is ​​calculated, and a normalized adjacency matrix is ​​obtained based on the self-loop enhanced adjacency matrix and the degree matrix. A normalized Laplacian matrix is ​​further constructed using the normalized adjacency matrix. The node feature matrix of the input data is normalized column-wise to make the feature scales of each dimension consistent, thus obtaining a standardized feature matrix. Step 3: Use the power iteration method to approximate the largest eigenvalue of the normalized Laplace matrix; Step 4: Calculate the degree distribution vector of the graph using the obtained normalized adjacency matrix; Step 5: Based on the obtained maximum eigenvalue and degree distribution vector, generate weight and bias vectors through two independent MLPs with ReLU activation, and then combine the three basic quadratic filtering functions as basis functions to integrate the weights and biases to obtain the final adaptive spectral filtering function. Step 6: Obtain the filtered node feature representation based on the adaptive spectral filtering function; Step 7: Perform graph convolution propagation on the node feature representations to obtain node prediction results. Add layer normalization and dropout to each layer of the graph convolution. Step 8: Optimize model parameters through supervised training based on the preprocessed training set data; Step 9: After training and optimization are completed, evaluate the performance on the test set using the optimal model parameters.

2. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 4 is as follows: Calculate the degree value of each node in the input data node set and normalize it. Then, divide the interval [0,1] into a fixed number of equal-width sub-intervals and count the proportion of nodes in each interval. Finally, arrange these proportions in interval order to form a degree distribution vector of fixed length.

3. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 6 is as follows: The normalized Laplacian matrix is ​​decomposed into eigenvalue matrices. Then, the eigenvalue matrix is ​​scaled and normalized based on the largest eigenvalue to make it fall into a predefined range. Finally, the normalized eigenvalue matrix is ​​projected into the spectral domain and weighted and modulated at each frequency component according to the adaptive spectral filtering function. The result is then inversely transformed back to the node domain to obtain the filtered node feature representation.

4. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 8 is performed as follows: In each training round, the node prediction results are compared with the training labels, the prediction error is measured by cross-entropy loss, and the error is propagated to the parameters of each layer using backpropagation; the model parameters are updated based on gradients through an adaptive optimization algorithm. During training, the model performance is monitored using a validation set. Early stopping and hyperparameter adjustment are determined based on the validation loss until training converges, and finally the trained model is obtained.

5. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 9 is as follows: The performance was evaluated using classification accuracy during the testing phase. In addition, to assess the robustness of the model, it was tested under different attack intensities or types, and its performance differences on clean graphs and adversarial graphs were compared to verify the anti-disturbance capability of adaptive spectral filtering.

6. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 3 is detailed below: (1) Initialization: Randomly initialize a non-zero vector. Normalize it to the identity norm as an approximate eigenvector. ; (2) Iteration: In the kth iteration, the intermediate vector is calculated first. Then, norm normalization is performed on the intermediate vector to obtain a new approximate eigenvector. The Rayleigh quotient is calculated using this approximate eigenvector as an estimate of the current largest eigenvalue. ; (3) Convergence: When the relative difference of the estimated values Less than the preset threshold or reaching the maximum number of iterations. The iteration terminates at time, and with As the required maximum eigenvalue.

7. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 2, characterized in that, Step 4 is as follows: (1) Traverse the normalized adjacency matrix This yields the degree value of each node. , in, Represents a node The degree value; Then, normalization is performed, which involves dividing the original degree of the node by the maximum degree in the graph. The normalization value is obtained between 0 and 1. : (2) In the interval The upper part is pre-divided into a fixed number of sub-intervals: in, Indicates the first Sub-intervals, This represents the total number of subintervals. Indicates the index of the sub-interval; Map the normalized value of each node to the corresponding interval, and count the proportion of nodes falling into each interval out of the total number of nodes: in, Indicates the first Sub-intervals The corresponding node ratio; (3) Finally, these proportions are arranged in interval order to form a degree distribution vector of fixed length: 。 8. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 1, characterized in that, Step 5 is detailed below: (1) Introduce three types of basic quadratic filtering functions as basis functions: in, , , These represent the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively. Represents the normalized graph Laplace matrix eigenvalues; (2) Degree distribution vector As input, a weight vector is generated through a two-layer MLP with ReLU activation. Specifically: in, It is the parameter of the first MLP. and These are the outputs of the first and second layers of the first MLP, respectively. The output of the second layer of the first MLP is obtained through softmax. Mapped to a non-negative weight vector that sums to 1 : in, These represent the weights of the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively. (3) The largest eigenvalue As input to another two-layer MLP with ReLU activation, a translation vector is generated. The format is: in, It is the parameter of the second MLP. and These are the outputs of the first and second layers of the second MLP, respectively. These represent the shift amounts for the low-pass filter function, the band-stop filter function, and the high-pass filter function, respectively. (4) Integrate the weights and biases to obtain the adaptive spectral filtering function. : In matrix form, the corresponding spectral function is: in, Represents the eigenvalues ​​in matrix form.

9. The graph convolutional network adversarial defense method based on adaptive spectral filtering according to claim 3, characterized in that, Step 6 is detailed below: (1) Eigenvalue decomposition; for the normalized Laplace matrix Perform eigenvalue decomposition to obtain the orthogonal eigenvector matrix. and diagonal eigenvalue matrix : in, Indicates the first One eigenvalue; (2) Eigenvalue normalization; based on the obtained largest eigenvalue diagonal eigenvalue matrix Scale normalization is performed on the eigenvalues ​​in the data. (3) Spectral domain filtering; given the normalized feature matrix Using the orthogonal eigenvector matrix As a graph Fourier basis, the normalized feature matrix is ​​subjected to a graph Fourier transform, projecting it from the nodal domain to the spectral domain: in, Represents the characteristic matrix in the spectral domain; In the spectral domain, the spectral coefficients corresponding to each graphical Laplace eigenvalue, i.e., each frequency component, are sequentially filtered according to the adaptive spectral filtering function. Weighting: in, This represents the weighted spectral domain characteristic matrix; Then, the inverse graph Fourier transform is used to transform back to the node domain, resulting in the filtered node feature matrix. : 。

Images