A robust GNN defense method implemented through neighborhood perceptron and collaborative contrast learning

Abstract

This invention relates to a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning, comprising: dividing initial node features into feature groups and assigning an encoder to each feature group; constructing a loss function for a semi-supervised learning task based on the difference between training labels and model outputs; constructing a loss function for a self-supervised learning task based on the output difference between any two encoders; training each encoder, and when the prediction results of each encoder for the same node in the test set are the same, merging the node and its predicted label into the training set; using a multilayer perceptron to output the confidence scores of adversarial edges of all edges, and combining the confidence scores of adversarial edges with the real-time degree distribution of nodes in the graph to obtain the optimal graph structure; and designing a unique cooperative contrastive learning paradigm, which solves the problems of insufficient training information and unstable node representation, thereby improving graph robustness.

Description

Technical Field

[0001] This invention relates to the field of graph neural network security technology, and in particular to a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning. Background Technology

[0002] Graph Neural Networks (GNNs) effectively capture node relationships and global graph information through their core mechanism—information transfer. Among them, Graph Convolutional Networks (GCNs) have achieved significant success in downstream tasks such as node classification, link prediction, and graph classification. GNNs have been widely applied in knowledge graphs, recommender systems, and biomolecular structure prediction. However, recent research has shown that GNNs are highly sensitive to adversarial attacks, especially well-designed structural attacks. Even small perturbations in the graph structure can lead to incorrect inferences by the model. Therefore, designing more robust GNNs and proposing effective defense strategies to ensure their robustness in critical applications is crucial. To address malicious adversarial attacks and improve the robustness of GNNs, some existing methods focus on anomaly edge detection. These methods explore the intrinsic relationships between nodes and edges, or the differences between clean and adversarial samples. Essentially, they protect the adjacency matrix by removing obvious anomalous edges from the graph structure, enabling GNNs to learn robust node representations. Furthermore, many researchers have extended contrastive learning strategies to graph representation learning. By augmenting the graph structure with views and comparing node representations under different views, these methods can reduce the impact of noise and adversarial attacks. Therefore, contrastive learning enables the direct generation of robust node representations during training without recovering the graph structure. However, we observe that existing detection methods typically rely on threshold-based edge detection, which is highly unstable and difficult to set. Lacking clear guidelines, researchers often set thresholds empirically, leading to significant variations in thresholds across different environments and high sensitivity to noise. Furthermore, contrastive learning methods are highly dependent on view generation. While these methods can mitigate node representation shifts under attacks, they have limitations in simulating diverse attack scenarios. Moreover, they often overlook the problem of insufficient training information, especially with small training sets. Summary of the Invention

[0003] This invention addresses the technical problems existing in the prior art by providing a robust GNN defense method implemented through a neighborhood perceptron and collaborative contrastive learning. The contrastive learning paradigm can utilize more information without relying on view generation, and the adversarial edge detection process is stable and reliable without relying on sensitive thresholds. It not only enhances the robustness of node representations but also recovers the graph structure.

[0004] According to a first aspect of the present invention, a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning is provided, comprising: Step 1: Divide the initial node features into feature groups and assign an encoder to each feature group; Step 2: Construct a loss function for the semi-supervised learning task based on the difference between the training labels and the model output; construct a loss function for the self-supervised learning task based on the output difference between any two encoders; train each encoder based on the semi-supervised learning task and the self-supervised learning task; when the prediction results of each encoder for the same node in the test set are the same, the node and its prediction label are merged into the training set. Step 3: Transform the problem of identifying adversarial edges into an out-of-distribution problem. Use a multilayer perceptron to output the confidence scores of all adversarial edges. Combine the confidence scores of the adversarial edges with the real-time degree distribution of the nodes in the graph to obtain the optimal graph structure.

[0005] Based on the above technical solution, the present invention can also be improved as follows.

[0006] Optionally, the process of dividing the initial node features into feature groups and assigning an encoder to each feature group in step 1 includes: Step 101: Based on the condition that the intersection between any of the feature groups is an empty set and the union of all the feature groups is the initial node feature, the initial node feature is randomly divided into multiple feature groups. Step 102: The GNN is replicated into multiple models, the number of which corresponds to the number of feature groups. The encoder of each model is trained on the initial training set using the feature groups obtained by its respective partitioning, sharing the graph structure.

[0007] Optionally, in step 2, the semi-supervised learning task is performed based on the label set; The loss of the semi-supervised learning task is ; in, For any i-th node in the test set, For the training set, For the loss function in classification tasks, For classification models, For model output, Let be the pseudo-label of the i-th node in the training set.

[0008] Optionally, the loss of the self-supervised learning task is expressed as: .

[0009] in, The number of feature groups For any i-th node in a single test set; ; This represents a similarity measure between two node representations. It is the temperature coefficient; Different view representations of the same node; A view representation of different nodes.

[0010] Optionally, the training set update process in step 2 includes: Step 201: Generate the original training set based on the original data and labels; Step 202, for any node in the test set When all the encoders produce the same prediction result and the confidence level of the prediction result exceeds a set threshold, the node is... Incorporated into the training set; Step 203, set the maximum size of the training set to The training set update stops when its size reaches the maximum value; wherein, It is the original training set. It is a set of nodes.

[0011] Optionally, step 2 further includes: constructing a multi-task learning loss function, and training each encoder based on the multi-task learning loss function; The multi-task learning loss function is: ; Let be the loss function for the semi-supervised learning task. Let be the loss function for the self-supervised learning task; The weight parameters are set.

[0012] Optionally, step 3, which transforms the problem of identifying adversarial edges into an out-of-distribution problem and uses a multilayer perceptron to output the adversarial confidence of all edges, includes: The multilayer perceptron performs supervised learning of edges based on the edge attributes and adversarial labels of the input samples, and outputs the adversarial probability of a given edge. The samples used for supervised learning by the multilayer perceptron include: negative samples and positive samples; The negative samples are normal edges. ;in, Indicates edge The attributes, The adjacency matrix is ​​used; the negative samples are the original edges in the sample graph. The positive samples are adversarial edges. ;in, The adjacency matrix is ​​perturbed; the positive samples are generated using a proxy attack. The edge attribute is ,in It is a function for concatenating attributes. and These are the attributes of the two end nodes of the edge.

[0013] Optionally, the multilayer perceptron is a classifier composed of feature angles. Local topological angle classifier and global representation angle classifier The MLP group consists of; The output mode of the MLP group is represented as follows: ; ; The , and The inputs are as follows: ; and Representing edges respectively The node feature vectors of the two end nodes i and j, and Representing edges respectively The graph orbit vectors of the two end nodes i and j, and Representing edges respectively The node representation generated by the proxy task of the two end nodes i and j.

[0014] Optionally, step 3, which combines the adversarial confidence score and the real-time degree distribution of nodes in the graph to obtain the optimal graph structure, includes: Step 301: Summarize the outputs of all MLP groups to obtain the confidence score for the adversarial edge: ,in It is the number of MLP groups; Step 302, score the confidence level of the adversarial edge. Sort in descending order of size; Step 303: Remove the edges sequentially according to the aforementioned order, removing any one edge. Then, the measurement parameters are fitted onto the updated graph structure using the least squares method. and The reliability of the updated graph structure is determined based on the difference between the measured parameters and the baseline values. If it is unreliable, the edges are adjusted. Perform the removal operation; if reliable, then remove the edge. The reliability of the next edge is then assessed. Among them, the measurement parameters and This indicates that the degree distribution of nodes follows a power-law distribution. The distribution parameters, It is the degree of the node. It is the number of nodes with that degree; Step 304: After removing all edges, select the measurement parameter with the smallest norm as the optimal measurement parameter, and determine the adjacency matrix based on the optimal measurement parameter as the optimal graph structure. .

[0015] Optionally, the reference value of the measured parameter in step 303 and The calculation formula is: ; ; in, Let covariance function be used. It is the variance function; The formula for calculating the difference between the measured parameter and the reference value is as follows: ; In step 304, the square norm is used to determine the optimal graph structure, and the calculation formula is as follows: .

[0016] This invention provides a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning. It constructs a cooperative contrastive learning paradigm that eliminates the need for additional view generation, thereby more effectively utilizing training information and significantly enhancing the robustness of node representations. A novel neighborhood perceptron is constructed that treats adversarial edges as out-of-distribution cases and utilizes high-quality pooling properties to accurately identify anomalous edges. An adaptive edge removal algorithm is designed, using the degree distribution of nodes to guide edge removal, thus eliminating reliance on sensitive thresholds. Effective adversarial defense can be implemented on the graph. Attached Figure Description

[0017] Figure 1 is a flowchart of an embodiment of a robust GNN defense method implemented by a neighborhood perceptron and cooperative contrastive learning provided by the present invention; Figure 2 This is a schematic diagram of an embodiment of a robust GNN defense method implemented by a neighborhood perceptron and cooperative contrastive learning provided by the present invention. Figure 3 A detailed process diagram of the collaborative labeling process in a training instance provided in an embodiment of the present invention; Figure 4A diagram showing the relationship between the error vector norm and the graph structure difference provided in this embodiment of the invention; Figure 5 This is a schematic diagram illustrating the impact of the number of MLP groups on the performance of a graph neural network, as provided in an embodiment of the present invention. Figure 6 A schematic diagram illustrating the impact of the number of encoders on the performance of a graph neural network, provided in an embodiment of the present invention; Figure 7 This is a comparison image before and after anti-edge removal provided in an embodiment of the present invention. Detailed Implementation

[0018] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0019] The technical terms used in this embodiment will be explained and described below: Graph representation learning is a technique that maps elements such as nodes, edges, and subgraphs in a graph structure into low-dimensional dense vectors while preserving information such as the graph's topology, node attributes, and semantic relationships.

[0020] Graph adversarial attacks: These are attack methods that add carefully designed perturbations to the structure or node features of graph data to mislead graph machine learning models into making incorrect predictions.

[0021] Graph adversarial defense: a defense strategy that resists graph adversarial attacks and maintains the accuracy of model predictions by enhancing the robustness of graph machine learning models to malicious perturbations or by purifying the attacked graph data structure and features.

[0022] Graph contrastive learning is an unsupervised learning method for graph data. It constructs enhanced views of the same node as positive samples and views between different nodes as negative samples. It uses contrastive loss to train a graph neural network encoder to learn high-quality node representations that can preserve graph topology and feature information.

[0023] Collaborative training is a semi-supervised learning framework that utilizes multiple different models to collaboratively and iteratively train on a small amount of labeled data and a large amount of unlabeled data, providing pseudo-labels to each other and improving model performance.

[0024] Out-of-distribution problem: A small subset of data in the sample has a distribution that differs significantly from the rest of the data.

[0025] Abnormal edge detection: By detecting and removing abnormal edges in the graph, GNNs can learn robust node representations on the restored graph structure.

[0026] Accuracy: This is the proportion of positive samples correctly predicted by the model out of all samples predicted as positive. It is used to measure the accuracy of positive predictions in the classification results.

[0027] Figure 1 A flowchart illustrating an embodiment of a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning provided by the present invention is shown below. Figure 1 As shown, the method includes: Step 1: Divide the initial node features into feature groups and assign an encoder to each feature group.

[0028] Step 2: Construct a loss function for the semi-supervised learning task based on the difference between the training labels and the model output; construct a loss function for the self-supervised learning task based on the output difference between any two encoders; train each encoder based on the semi-supervised learning task and the self-supervised learning task, and when the prediction results of each encoder for the same node in the test set are the same, merge that node and its predicted label into the training set.

[0029] By expanding the training set through a collaborative labeling strategy involving all encoders, the encoders can learn more node information. The outputs of these encoders are used to limit the representational differences between encoders, and self-supervised learning and semi-supervised learning are combined to constrain the training direction of the entire model, thus constructing a collaborative contrastive learning paradigm.

[0030] Step 3: Transform the problem of identifying adversarial edges into an out-of-distribution problem. Use a multilayer perceptron to output the confidence scores of all adversarial edges. Combine the confidence scores of adversarial edges with the real-time degree distribution of nodes in the graph to obtain the optimal graph structure.

[0031] In practice, by constructing a neighborhood perceptron, the problem of identifying adversarial edges is transformed into an out-of-distribution problem.

[0032] This invention provides a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning. By using a unique cooperative contrastive learning paradigm, it solves the problems of insufficient training information and unstable node representation. Constructing a neighborhood perceptron transforms the problem of identifying adversarial edges into an out-of-distribution problem. The neighborhood perceptron does not rely on difficult-to-set threshold parameters, thus improving the robustness of the graph. Example 1

[0033] Embodiment 1 provided by this invention is an embodiment of a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning, as provided by this invention. Figure 2 The diagram shown is a schematic representation of an embodiment of a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning provided by the present invention. Figure 1 and Figure 2 It can be seen that embodiments of this GNN defense method include: Step 1: Divide the initial node features into feature groups and assign an encoder to each feature group.

[0034] In one possible embodiment, the process of dividing the initial node features into feature groups and assigning an encoder to each feature group in step 1 includes: Step 101: Based on the condition that the intersection of any feature groups is an empty set and the union of all feature groups is the initial node feature, the initial node feature is randomly divided into multiple feature groups.

[0035] In specific implementation, the initial node features Divide into several disjoint subsets Each subset satisfies the following conditions: ,in Represents the empty set. This represents the original feature dimension.

[0036] Step 102: The GNN is replicated into multiple models, with the number of models corresponding to the number of feature groups. The encoder of each model is trained on the initial training set using the feature groups it has divided, sharing the same graph structure.

[0037] Then copy GNN as A model Each model utilizes its own partitioning features on the initial training set. Go to training, ,in yes The generated node representation, Let be the adjacency matrix of the graph.

[0038] Step 2: Construct a loss function for the semi-supervised learning task based on the difference between the training labels and the model output; construct a loss function for the self-supervised learning task based on the output difference between any two encoders; train each encoder based on the semi-supervised learning task and the self-supervised learning task, and when the prediction results of each encoder for the same node in the test set are the same, merge that node and its predicted label into the training set.

[0039] In one possible embodiment, step 2 is based on the tag set. Perform semi-supervised learning tasks.

[0040] The loss of a semi-supervised learning task is .

[0041] in, For the test set For any i-th node in, For the training set, For the loss function in classification tasks, For classification models, For model output, Let be the pseudo-label of the i-th node in the training set.

[0042] In specific implementation, through the encoder Obtain model output The model's output is obtained by passing the mean function through all encoder outputs, i.e. ,in It's the SoftMax function. yes The node representation output by the encoder.

[0043] In one possible implementation, co-training naturally generates multiple node representations, which eliminates the need for additional view generation in contrastive learning. First, different view representations of the same node are... Treated as positive sample pairs Views of different nodes are treated as negative sample pairs. These constraints cause the representations of identical nodes to tend to be consistent, while the view representations of different nodes tend to be different. The above loss is constructed using the InfoNCE loss: ,in This represents a similarity measure between two node representations. It is the temperature coefficient. Therefore, the loss for the self-supervised learning task is expressed as: .

[0044] The self-supervised learning task limits the output difference between any two encoders, that is, reduces the difference between representations of the same node and amplifies the difference between representations of different nodes. The output difference of all nodes is used as the loss function of the self-supervised learning task.

[0045] In one possible embodiment, the training set update process in step 2 includes: Step 201: Generate the original training set based on the original data and labels.

[0046] Step 202, for the test set any node in All encoders produced the same prediction result, and the confidence level of that prediction result exceeded a set threshold. If the predicted label is then considered reliable, the node will be... Temporarily merged into the training set: .

[0047] Once the training process is approximately complete, based on the encoder... The output of the training set The training is then expanded. It is assumed that training is approximately complete when the loss on the validation set no longer decreases, and that the training set can be expanded multiple times. All initial training labels and temporary training labels together constitute the training labels, which are used to guide encoder training.

[0048] Step 203: To avoid introducing additional noise, it is necessary to limit the maximum size of the training set. The maximum size of the training set is set to [value to be filled in]. The training set update stops when it reaches its maximum size; among which, It is the original training set. It is a set of nodes.

[0049] In one possible embodiment, step 2 further includes: constructing a multi-task learning loss function and training each encoder based on the multi-task learning loss function.

[0050] The multi-task learning loss function is: .

[0051] Let be the loss function for the semi-supervised learning task. Let be the loss function for the self-supervised learning task; The weight parameters are set.

[0052] To jointly optimize the loss, weight parameters are introduced. Set the skewness of the self-supervised learning task.

[0053] Step 3: Transform the problem of identifying adversarial edges into an out-of-distribution problem. Use a multilayer perceptron to output the confidence scores of all adversarial edges. Combine the confidence scores of adversarial edges with the real-time degree distribution of nodes in the graph to obtain the optimal graph structure.

[0054] In one possible embodiment, step 3, which transforms the problem of identifying adversarial edges into an out-of-distribution problem, and uses a multilayer perceptron to output the adversarial confidence of all edges, includes: Multilayer perceptrons perform supervised learning of edges based on the edge attributes and adversarial labels of the input samples, and then output the adversarial probability of a given edge.

[0055] The samples used for supervised learning by a multilayer perceptron include negative samples and positive samples.

[0056] Negative samples are normal edges ;in, Indicates edge The attributes, is the adjacency matrix; negative samples are the original edges in the sample graph.

[0057] Positive samples are adversarial edges ;in, The adjacency matrix is ​​perturbed; positive samples are generated using proxy attacks.

[0058] Edge properties are ,in It is a function for concatenating attributes. and These are the attributes of the two end nodes of the edge.

[0059] The problem of identifying adversarial edges is modeled as an out-of-distribution problem, where normal edges are considered in-distribution edges, and adversarial edges are considered out-of-distribution edges. The goal then becomes identifying adversarial edges based on the distribution. However, typical graph data does not contain explicit edge attributes, so it is necessary to define edge attributes manually. An edge represents a connection between two endpoints, so edge attributes are defined using the attributes of the two endpoints. Define edge properties.

[0060] Typical node attributes include node feature vectors. and the node representation generated by the proxy task They are divided from the perspectives of features and global representation, respectively. Due to message passing, global information tends to make the graph representation smoother, which weakens the differences between different nodes. To address this issue, graph trajectory vectors are introduced. As a node attribute based on local topology, it can capture local topological information. Therefore, based on the perspectives of features, local topology, and global representation, it can be divided into feature attributes, local topology attributes, and global representation attributes.

[0061] After training, all edges in the current graph structure are identified, and the edges with high confidence are most likely to become adversarial edges.

[0062] In one possible implementation, if these attributes are mixed into a single MLP, the model's internal weight parameters may become highly unbalanced. To achieve optimal performance, an MLP group consisting of three dedicated classifiers was designed: (Feature angle) (Local topological perspective) and (Global Representation Perspective) Each classifier specializes in processing a specific type of data. This approach not only ensures accuracy in detecting adversarial edges but also allows the model to identify the boundary between adversarial and normal edges from the perspectives of features, local topology, and global representation, based on edge attributes, through a multilayer perceptron. Finally, the model jointly outputs the confidence score of the identified adversarial edges.

[0063] Multilayer perceptron is a classifier based on feature angles. Local topological angle classifier and global representation angle classifier The MLP group consists of...

[0064] The output mode of the MLP group is represented as follows: ; .

[0065] , and The inputs are as follows: .

[0066] and Representing edges respectively The node feature vectors of the two end nodes i and j, and Representing edges respectively The graph orbit vectors of the two end nodes i and j, and Representing edges respectively The node representation generated by the proxy task of the two end nodes i and j.

[0067] In one possible implementation, these attributes are averaged to obtain corresponding high-quality pooled attributes, which are then fed into the MLP group for training.

[0068] In one possible implementation, step 3, which combines adversarial confidence and the real-time degree distribution of nodes in the graph to obtain the optimal graph structure, includes: Step 301: Summarize the outputs of all MLP groups to obtain the confidence score for the adversarial edge. : ,in It represents the number of MLP groups.

[0069] Given the uncertainty of adversarial attacks, multiple attacks are performed to cover a wider range of potential adversarial edges. Simultaneously, the number of MLP groups is increased accordingly. While more MLP groups improve the accuracy of adversarial edge detection, they also incur additional computational costs. Since each MLP outputs the probability that an edge is adversarial, the outputs of all MLP groups and all MLPs within each group are aggregated.

[0070] Step 302: Score the confidence level of the adversarial edge. Sort by size in descending order.

[0071] Step 303: A greedy strategy is used to remove edges. Edges are removed sequentially according to their order to achieve a locally optimal graph structure. When removing any edge... Then, the measurement parameters are fitted onto the updated graph structure using the least squares method. and The reliability of the updated graph structure is determined based on the difference between the measured parameters and the baseline values. If it is unreliable, the edges are adjusted. Perform the removal operation; if reliable, then remove the edge. The reliability of the next edge is then assessed.

[0072] Among them, measurement parameters and This indicates that the degree distribution of nodes follows a power-law distribution. The distribution parameters, It is the degree of the node. It represents the number of nodes with that degree.

[0073] Specifically, head nodes in the graph tend to have higher degrees, while long-tail nodes typically have lower degrees. A least-squares fitting method is used to fit the power-law distribution to a clean graph. The exponential parameter can be eliminated by applying a logarithmic transformation.

[0074] In one possible embodiment, the reference value of the measured parameter in step 303 is... and The calculation formula is: .

[0075] .

[0076] in, Let covariance function be used. It is the variance function.

[0077] The formula for calculating the difference between the measured parameter and the reference value is: .

[0078] Because the magnitudes of these two measurement parameters differ significantly, relative error is used.

[0079] Using a benchmark value as a basis, the difference between the measured parameters and the benchmark value is evaluated. If the measured parameters are similar to the benchmark parameters, the current graph structure is considered reliable. Therefore, the objective becomes finding the minimum relative error.

[0080] Step 304: After removing all edges, select the measurement parameter with the smallest norm as the optimal measurement parameter, and determine the adjacency matrix based on the optimal measurement parameter as the restored optimal graph structure. Ultimately, reasoning is performed on the recovered graph structure.

[0081] In one possible embodiment, step 304 uses the square norm to determine the optimal graph structure, calculated as follows: .

[0082] After training the MLP group, potential adversarial edges are removed from the attacked graph. Existing methods typically rely on threshold-based discrimination. When the MLP predicts that an edge is an adversarial edge with a probability exceeding a certain threshold, that edge is removed from the graph. However, setting an appropriate threshold is very difficult because it is highly dependent on the dataset, perturbation rate, attack method, and other factors. Furthermore, threshold-based methods lack clear guidelines, which can easily lead to the incorrect removal of a small number of real edges. To address these limitations, an adaptive edge removal mechanism is designed, combining a greedy algorithm with least-squares fitting.

[0083] By utilizing confidence levels and employing an adaptive edge removal algorithm, existing edges are progressively identified and the graph structure is updated. The relative error of the fitting parameters is optimized using the least squares fitting method and a greedy strategy, thereby achieving the removal of adversarial edges. Example 2

[0084] Embodiment 2 of this invention provides an application example of a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning. Table 1 shows the experimental results of this embodiment comparing the robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning with other methods. As can be seen from Table 1, the performance metrics of this embodiment are higher than all other comparative models. Specifically, the classification accuracy of this embodiment on Cora, Citeseer, and Polblogs is improved by 1.71%, 2.24%, and 3.01%, respectively. On one hand, the pseudo-labels generated by cooperative training in this embodiment enable the GCN model to learn more comprehensive knowledge. Trusted nodes transform unlabeled samples into labeled samples, allowing this embodiment to continuously train valuable information without prematurely triggering early stopping. On the other hand, the contrastive learning strategy enhances the robustness of node representations. This embodiment utilizes multiple feature subsets to construct contrastive node representations, enabling models to supervise each other. This training mode reduces the prediction bias of individual models, enabling this embodiment to achieve higher performance and robustness. Furthermore, the MLP group in the neighborhood perceptron addresses the adversarial edge detection problem by analyzing the distribution of edge attributes. Multiple MLP groups and diverse perspectives within each group provide strong evidence to distinguish adversarial edges. Simultaneously, the adaptive edge removal mechanism guides the restoration of the graph structure based on the degree distribution of nodes. Therefore, the embodiments of this invention not only achieve superior model performance but also exhibit stronger robustness against adversarial attacks.

[0085] Table 1 also shows that the results of the embodiments of the present invention are more stable. Real-world data often contains noise, which can significantly affect model performance. Only models that can produce reliable and stable outputs are suitable for practical applications. In the experiments, a smaller standard deviation indicates higher consistency in the model output. The standard deviation of the embodiments of the present invention was observed to be less than 1.05% in all scenarios, indicating that the embodiments of the present invention are both stable and reliable, making them more tolerant of noise. In contrast, other baseline models exhibit greater volatility, especially GNNGuard, Soft-Median, and ADEdgeDrop. In the Polblogs dataset, their standard deviations even exceeded 3%, indicating that their actual performance depends to some extent on randomness. Therefore, the embodiments of the present invention have higher practical value in real-world environments due to their superior stability.

[0086] Table 1 also shows that the embodiments of the present invention have very little dependence on node features. Notably, on the Polblogs dataset, the baseline model shows a performance gap of up to 5% between 0% and 20% attack budgets. This is mainly because Polblogs lacks node features, forcing these models to rely solely on the perturbed graph structure for node prediction. Furthermore, Jaccard cannot work on Polblogs because it cannot compute feature similarity. In contrast, the embodiments of the present invention recover the graph structure based on degree distribution, thereby maximizing the recovery of the model's representational power. Due to its adaptive edge removal mechanism, the embodiments of the present invention further reduce the performance gap to 1.07%. These results demonstrate that CCLNP maintains strong performance even without relying on node features, thus enhancing the robustness of GNN models.

[0087] Table 1. Experimental results comparing the embodiments of the present invention with other methods. To investigate the contributions and interactions of the various components in this embodiment, an ablation study was conducted, as shown in Table 2. "w / o CCL" indicates the removal of the cooperative contrastive learning paradigm. In this stage, the standard GCN is used to handle the proxy task. "w / o NP" indicates the removal of the neighborhood perceptron (and adaptive edge removal mechanism). The model is evaluated directly on the perturbed graph without restoring the graph structure. Experimental results show that each designed component contributes positively to the overall performance. In other words, this embodiment achieves optimal results only when all components work collaboratively. On the Cora and Citeseer datasets, this embodiment outperforms other baseline models even without NP. This is because CCL not only extracts more potential high-quality knowledge but also performs contrastive learning from different feature perspectives. The ablation study results further validate the superiority of CCL. On the Polblogs dataset, CCL's performance rapidly declines due to a lack of available node features. In this case, NP plays a crucial role by utilizing the degree distribution as guiding information to reconstruct the graph. Therefore, even without CCL, this embodiment still outperforms other baseline models on Polblogs.

[0088] Table 2. Ablation Study of Embodiments of the Invention Table 3 evaluates the effectiveness of the embodiments of the present invention under various adversarial attack scenarios when the proxy attack is PGD. The attack types considered include DICE, PGD, and Metaltack. Experimental results show that the embodiments of the present invention consistently outperform the undefended GCN under all attack types and budgets. Notably, when the attack types are PGD and Metaltack, the embodiments of the present invention perform better under high attack budgets (20%) than GCN under low budgets (5%), demonstrating the strong robustness of the embodiments of the present invention. However, this advantage is diminished under DICE attacks because DICE disrupts connections between similar nodes, thus violating the assumption that similar nodes are more likely to connect. Therefore, in this case, the performance of both GCN and the embodiments of the present invention significantly decreases. Nevertheless, under an attack budget of 20%, the embodiments of the present invention still outperform GCN by 1.4% and 2% on the Cora and Citeseer datasets, respectively. The above results demonstrate that the embodiments of the present invention can cope with adversarial attacks of various types and budgets.

[0089] Table 3. Performance of the embodiments of the present invention against different types of attacks Figure 3 This is a detailed process diagram of the collaborative labeling process provided in an embodiment of the present invention within a training instance. Figure 3The complete training process was recorded to analyze the detailed steps of co-labeling in this embodiment of the invention. Specifically, after each training set expansion, the new training set size and statistical data on the labeling accuracy generated by co-training were collected. As the number of training set expansions increased, the training set size grew from the initial 10% to approximately 40% of the total dataset. This embodiment of the invention converts unlabeled nodes into effective training signals, thereby achieving more comprehensive model training. In addition, the following observations were made: (1) As the number of expansions increased, the co-labeling accuracy of the training set gradually decreased. In the Cora and Citeseer datasets, the accuracy decreased to 96% and 91%, respectively; (2) After the first expansion, this embodiment of the invention expanded the training set of the Citeseer dataset by nearly 11% of the total dataset, while it only increased it by 5% in Cora; (3) With the same number of training rounds, this embodiment of the invention continuously expanded the training set 39 times on the Cora dataset, while this number decreased to 20 times on the Citeseer dataset; (4) After the final training set expansion, this embodiment of the invention increased the training set size of Cora to 45% and Citeseer to 35%. Based on the joint training process, the collaborative labeling efficiency of the embodiments of the present invention is analytically demonstrated to be closely related to the performance of the base GNN model. GCN generally performs better on Cora, providing more useful and accurate training signals. However, on Citeseer, the pseudo-labeled samples selected by GCN contain more noise, leading to error propagation during iterative training. This may result in the repeated use of incorrect label information, potentially making the model unreliable. To address the error propagation problem, the embodiments of the present invention propose two effective strategies: (1) selecting a more robust and superior GNN model as the underlying encoder to improve the accuracy of collaborative labeling; (2) setting an appropriate maximum training set size to reduce the introduction of noise.

[0090] Figure 4 This is a diagram showing the relationship between the error vector norm and the graph structure difference provided in an embodiment of the present invention. Figure 4 The effectiveness of the adaptive edge removal mechanism was verified. The figure illustrates the relationship between the dissimilarity between the restored and original graph structures and the norm of the fitted parameters. Furthermore... Figure 4The recovery results are annotated, with particular emphasis on the graph structure corresponding to the minimum norm of the fitted parameters. In the Cora and Citeseer datasets, the trend of structural dissimilarity almost always aligns with the change in the norm of the fitted parameters. These experimental results strongly demonstrate that the degree distribution of nodes can effectively guide the edge removal process. Compared to threshold-based methods, the adaptive edge removal mechanism is more general and instructive. The dashed lines in the figure indicate that the minimum norm typically corresponds to the optimal graph structure. This also explains why the model still outperforms existing baselines on Polblogs even without CCL. Even degree-preserving attacks cannot evade this defense model. This is because the adaptive edge removal mechanism includes NP, which can distinguish adversarial edges based on the attribute distributions of the two end nodes. This mechanism simply guides the removal of edges and determines the optimal graph structure.

[0091] Figure 5 This is a schematic diagram illustrating the impact of the number of MLP groups on the performance of a graph neural network, as provided in an embodiment of the present invention. Figure 6 This is a schematic diagram illustrating the impact of the number of encoders on the performance of a graph neural network, as provided in an embodiment of the present invention. Figure 5 and Figure 6 The impact of the number of MLP groups in the neighborhood perceptron and the number of encoders in the collaborative contrastive learning paradigm on experimental results was investigated. Experimental results show that the number of MLP groups has little impact on the performance of the embodiments of the present invention. As the number of MLP groups increases from 1 to a certain value, the performance of the embodiments of the present invention gradually improves. When the number of MLP groups is small, their ability to identify adversarial edges is limited, leading to prediction bias in the neighborhood perceptron. As the number of MLP groups continues to increase, the ability to identify adversarial edges gradually plateaus, and the prediction performance of the neighborhood perceptron fluctuates within a certain range without further improvement. However, using more MLP groups increases training time. Therefore, the number of MLP groups can be chosen to balance performance and efficiency: Cora chose 5 groups, and Citeseer chose 7 groups. This configuration ensures optimal model performance while reducing training time.

[0092] When using only one encoder, the embodiments of the present invention lack sufficient information for co-contrast learning. Therefore, the available training information is very limited. Simultaneously, the lack of self-supervised constraints leads to ambiguous node representations. On the Cora dataset, using two encoders achieves optimal model performance. This is because the features available to a single encoder become increasingly sparse, significantly weakening the model's generalization ability. Furthermore, multiple poorly trained encoders may produce unreliable pseudo-labels, leading to the accumulation of error propagation. On the Citeseer dataset, the node feature dimension reaches 3703 (compared to 1433 in Cora). As the number of encoders in the embodiments of the present invention increases from 2 to 7, the model performance significantly improves, peaking at 7 encoders, where each encoder is most efficient at learning node features. Due to memory limitations, the performance of the embodiments of the present invention cannot be evaluated when the number of encoders exceeds 7. Therefore, to ensure optimal performance, the number of encoders is set to 2 for Cora and 7 for Citeseer.

[0093] Figure 7 This is a comparison image before and after anti-edge removal provided in an embodiment of the present invention. Figure 7 To more intuitively evaluate the ability of the embodiments of the present invention to recover graph structure, the nodes and edges of the Citeseer dataset were visualized. A subset of nodes and all edges between them were selected as the subgraph for evaluation. Figure 7 The upper half of the graph shows the structure of the perturbed graph, and the lower half shows the restored graph. Unperturbed edges are marked with thin gray lines, and perturbed edges are marked with thick red lines. Compared to the perturbed graph, the number of thick red lines in the restored graph is reduced by more than 70% across all four perturbing ratios. This demonstrates the effectiveness of the embodiments of the present invention in handling adversarial edges. At a 5% perturbing ratio, the restored graph structure contains only a small number of adversarial edges, significantly improving model performance. The embodiments of the present invention are evaluated from the perspective of the nodes in the graph at perturbing ratios of 15% and 20%. Figure 7 A node in the top-left region may generate numerous malicious connections, potentially affecting a large number of vulnerable nodes. Utilizing its adaptive edge removal mechanism, this embodiment of the invention can accurately remove all adversarial edges associated with that node. Therefore, this embodiment of the invention can effectively restore the graph structure.

[0094] This invention provides a robust GNN defense method implemented through a neighborhood perceptron and cooperative contrastive learning. It constructs a cooperative contrastive learning paradigm that eliminates the need for additional view generation, thereby more effectively utilizing training information and significantly enhancing the robustness of node representations. A novel neighborhood perceptron is constructed that treats adversarial edges as out-of-distribution cases and utilizes high-quality pooling properties to accurately identify anomalous edges. An adaptive edge removal algorithm is designed, using the degree distribution of nodes to guide edge removal, thus eliminating reliance on sensitive thresholds. Effective adversarial defense can be implemented on the graph.

[0095] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0096] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0098] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0099] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0100] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0101] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A robust GNN defense method implemented by neighborhood perceptron and cooperative contrast learning, characterized in that, The robust GNN defense method includes: Step 1: Divide the initial node features into feature groups and assign an encoder to each feature group; Step 2: Construct a loss function for the semi-supervised learning task based on the difference between the training labels and the model output; construct a loss function for the self-supervised learning task based on the output difference between any two encoders; train each encoder based on the semi-supervised learning task and the self-supervised learning task; when the prediction results of each encoder for the same node in the test set are the same, the node and its prediction label are merged into the training set. Step 3: Transform the problem of identifying adversarial edges into an out-of-distribution problem. Use a multilayer perceptron to output the confidence scores of all adversarial edges. Combine the confidence scores of the adversarial edges with the real-time degree distribution of the nodes in the graph to obtain the optimal graph structure.

2. The robust GNN defense method according to claim 1, characterized in that, Step 1, which involves dividing the initial node features into feature groups and assigning an encoder to each feature group, includes the following: Step 101: Based on the condition that the intersection between any of the feature groups is an empty set and the union of all the feature groups is the initial node feature, the initial node feature is randomly divided into multiple feature groups. Step 102: The GNN is replicated into multiple models, the number of which corresponds to the number of feature groups. The encoder of each model is trained on the initial training set using the feature groups obtained by its respective partitioning, sharing the graph structure.

3. The robust GNN defense method according to claim 1, characterized in that, In step 2, the semi-supervised learning task is performed based on the label set; The loss of the semi-supervised learning task is ; in, For any i-th node in the test set, For the training set, For the loss function in classification tasks, For classification models, For model output, Let be the pseudo-label of the i-th node in the training set.

4. The robust GNN defense method according to claim 1, characterized in that, The loss for the self-supervised learning task is expressed as: ； in, The number of feature groups For any i-th node in a single test set; ； This represents a similarity measure between two node representations. It is the temperature coefficient; Different view representations of the same node; A view representation of different nodes.

5. The robust GNN defense method according to claim 1, characterized in that, The training set update process in step 2 includes: Step 201: Generate the original training set based on the original data and labels; Step 202, for any node in the test set When all the encoders produce the same prediction result and the confidence level of the prediction result exceeds a set threshold, the node is... Incorporated into the training set; Step 203, set the maximum size of the training set to The training set update stops when its size reaches the maximum value; wherein, It is the original training set. It is a set of nodes.

6. The robust GNN defense method according to claim 1, characterized in that, Step 2 further includes: constructing a multi-task learning loss function, and training each encoder based on the multi-task learning loss function; The multi-task learning loss function is: ; Let be the loss function for the semi-supervised learning task. The loss function for the self-supervised learning task; The weight parameters are set.

7. The robust GNN defense method according to claim 1, characterized in that, Step 3, which transforms the problem of identifying adversarial edges into an out-of-distribution problem, and uses a multilayer perceptron to output the adversarial confidence of all edges, includes the following steps: The multilayer perceptron performs supervised learning of edges based on the edge attributes and adversarial labels of the input samples, and outputs the adversarial probability of a given edge. The samples used for supervised learning by the multilayer perceptron include: negative samples and positive samples; The negative samples are normal edges. ;in, Indicates edge The attributes, The adjacency matrix is ​​used; the negative samples are the original edges in the sample graph. The positive samples are adversarial edges. ;in, The adjacency matrix is ​​perturbed; the positive samples are generated using a proxy attack. The edge attribute is ,in It is a function for concatenating attributes. and These are the attributes of the two end nodes of the edge.

8. The robust GNN defense method according to claim 7, characterized in that, The multilayer perceptron is a feature angle classifier. Local topological angle classifier and global representation angle classifier The MLP group consists of; The output mode of the MLP group is represented as follows: ; ; The , and The inputs are as follows: ； and Representing edges respectively The node feature vectors of the two end nodes i and j, and Representing edges respectively The graph orbit vectors of the two end nodes i and j, and Representing edges respectively The node representation generated by the proxy task of the two end nodes i and j.

9. The robust GNN defense method according to claim 8, characterized in that, Step 3, which combines the adversarial confidence score and the real-time degree distribution of nodes in the graph to obtain the optimal graph structure, includes: Step 301: Summarize the outputs of all MLP groups to obtain the confidence score for the adversarial edge. : ,in It is the number of MLP groups; Step 302, score the confidence level of the adversarial edge. Sort in descending order of size; Step 303: Remove the edges sequentially according to the aforementioned order, removing any one edge. Then, the measurement parameters are fitted onto the updated graph structure using the least squares method. and The reliability of the updated graph structure is determined based on the difference between the measured parameters and the baseline values. If it is unreliable, the edges are adjusted. Perform the removal operation; if reliable, then remove the edge. The reliability of the next edge is then assessed. Among them, the measurement parameters and This indicates that the degree distribution of nodes follows a power-law distribution. The distribution parameters, It is the degree of the node. It is the number of nodes with that degree; Step 304: After removing all edges, select the measurement parameter with the smallest norm as the optimal measurement parameter, and determine the adjacency matrix based on the optimal measurement parameter as the optimal graph structure. .

10. The robust GNN defense method according to claim 7, characterized in that, The reference value of the measured parameter in step 303 and The calculation formula is: ； ； in, Let covariance function be used. It is the variance function; The formula for calculating the difference between the measured parameter and the reference value is as follows: ； In step 304, the square norm is used to determine the optimal graph structure. The calculation formula is as follows: .

Images