An anchor node space gradient enhancement adversarial sample generation method for a graph neural network

Abstract

An anchor node space gradient enhancement adversarial sample generation method for a graph neural network, the method comprising: obtaining graph data, an adjacency matrix, a node feature matrix, node labels, a test node set, a structure disturbance budget, an anchor node number, an auxiliary anchor node number, a balance parameter, and a graph neural network classifier; calculating a confidence correct boundary of the test node based on an output of the graph neural network classifier; sequentially performing confidence screening, low-degree screening, and decision boundary screening to obtain an anchor node set; sampling auxiliary anchor nodes for the main anchor nodes; constructing a weighted joint loss of the main anchor nodes and the auxiliary anchor nodes, and calculating a space enhancement gradient thereof with respect to an element of a candidate edge adjacency matrix; performing greedy edge addition or edge deletion according to the gradient amplitude and sign; and outputting a disturbed graph data, a disturbed adjacency matrix, or an adversarial sample generation result after iteration within the budget constraint.

Description

Technical Field

[0001] This invention relates to the fields of robustness testing of artificial intelligence models, graph data processing, and graph neural network technology, specifically to an anchor node spatial gradient enhancement adversarial example generation technique for graph neural networks. Background Technology

[0002] Graph neural networks can process non-Euclidean graph structured data through neighborhood information aggregation mechanisms and have been widely used in tasks such as node classification, link prediction, and graph clustering. For attribute graphs... Their topological relationships are usually determined by the adjacency matrix. This indicates that node attributes are derived from the feature matrix. This indicates that the graph neural network classifier is based on... and Output the probability of node category.

[0003] In evaluating the robustness of graph neural networks, researchers typically generate adversarial examples by applying slight perturbations to the graph structure before training or testing, in order to observe changes in the model's classification results. Existing methods for generating structural perturbation samples mostly employ global perturbation strategies or single-node gradient strategies. On the one hand, global strategies struggle to distinguish the sensitivity of different nodes to structural changes, and the limited budget may be distributed across robust nodes, resulting in low perturbation utilization efficiency. On the other hand, single-node gradients are susceptible to local noise interference, and the edge update direction may get trapped in local optima.

[0004] Therefore, a technical solution is needed that can screen high-value anchor nodes under a limited structural perturbation budget and enhance the gradient direction by utilizing the spatial correlation between anchor nodes, thereby improving the efficiency and stability of structural perturbation sample generation for graph neural networks. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a method for generating adversarial examples with spatial gradient enhancement for anchor nodes in graph neural networks. Under a finite structural perturbation budget, this method alleviates the problems of inefficient global perturbation resource allocation and noise interference on single-node gradients by using hierarchical anchor node selection and joint loss optimization of auxiliary anchor nodes.

[0006] This invention is a method for generating adversarial examples with spatial gradient enhancement for anchor nodes in graph neural networks, comprising the following steps: S1. Obtain the graph data to be processed, adjacency matrix, node feature matrix, node labels, test node set, structural perturbation budget, number of anchor nodes, number of auxiliary anchor nodes, balance parameters, and graph neural network classifier, wherein the graph data includes a node set and an edge set; S2. Input the adjacency matrix and node feature matrix into the graph neural network classifier to obtain the class probability output of the test nodes, and calculate the confidence correct boundary of each test node based on the class probability output. S3. Based on the confidence correctness boundary, node degree and decision boundary proximity, the test node set is hierarchically filtered to obtain the anchor node set; S4. For each main anchor node in the anchor node set, sample auxiliary anchor nodes from the anchor nodes other than the main anchor node to obtain an auxiliary anchor node set; S5. Construct a weighted joint loss based on the cross-entropy loss of the main anchor node and the cross-entropy loss of the set of auxiliary anchor nodes, and calculate the spatial enhancement gradient of the weighted joint loss relative to the candidate edge elements in the adjacency matrix. S6. Determine the perturbation score of the candidate edge based on the magnitude of the spatial enhancement gradient, and determine the edge addition or deletion operation based on the sign of the spatial enhancement gradient and the current connection state of the candidate edge; S7. Select candidate edges from high to low according to the perturbation score and update the adjacency matrix, and repeat S4 to S7 until the iteration termination condition or structural perturbation budget is reached. S8. Output the updated perturbation graph data, perturbation adjacency matrix, or adversarial example generation results for graph neural networks.

[0007] The beneficial effects of this invention are: by screening through three layers of confidence, node degree and decision boundary, this invention locates anchor nodes that are sensitive to structural disturbances and have high impact value from the test nodes, so that the finite structural disturbance budget is concentrated on the key nodes.

[0008] This invention introduces auxiliary anchor nodes for each main anchor node and constructs a weighted joint loss, enabling gradient calculation to simultaneously reflect the requirements of the main anchor node and the structural sensitivity of spatially related nodes, thereby reducing the impact of single-node gradient noise on candidate edge selection.

[0009] This invention maps continuous gradients to discrete edge addition or deletion operations, uses gradient magnitude as perturbation score and gradient sign to determine update direction, and can form a clear and implementable graph structure update process within the structural perturbation budget.

[0010] This invention is applicable to graph neural networks with different neighborhood aggregation mechanisms such as GCN, GAT, and GraphSAGE, and can be used for robustness evaluation, model testing, and defense verification of node classification models. Attached Figure Description

[0011] Figure 1 This is a flowchart of the method for generating adversarial examples with spatial gradient enhancement of anchor nodes in a graph neural network. Figure 2 A schematic diagram of the three-module structure for anchor node selection, spatial gradient enhancement, and perturbation map generation;Figure 3 A schematic diagram illustrating the impact of different anchor node selection methods on sample generation performance; Figure 4 A schematic diagram illustrating the impact of different gradient update methods on sample generation performance; Figure 5 Budget factors for different disturbances A schematic diagram illustrating the performance changes in sample generation. Figure 6 For different equilibrium parameters A schematic diagram illustrating the performance changes in sample generation. Figure 7 Sampling ratio for different auxiliary anchor nodes A schematic diagram illustrating the performance changes in sample generation. Detailed Implementation

[0012] like Figure 1 As shown, this invention is a method for generating adversarial examples with spatial gradient enhancement for anchor nodes in graph neural networks, comprising the following steps: S1. Obtain the graph data to be processed, adjacency matrix, node feature matrix, node labels, test node set, structural perturbation budget, number of anchor nodes, number of auxiliary anchor nodes, balance parameters, and graph neural network classifier, wherein the graph data includes a node set and an edge set; S2. Input the adjacency matrix and node feature matrix into the graph neural network classifier to obtain the class probability output of the test nodes, and calculate the confidence correct boundary of each test node based on the class probability output. S3. Based on the confidence correctness boundary, node degree and decision boundary proximity, the test node set is hierarchically filtered to obtain the anchor node set; S4. For each main anchor node in the anchor node set, sample auxiliary anchor nodes from the anchor nodes other than the main anchor node to obtain an auxiliary anchor node set; S5. Construct a weighted joint loss based on the cross-entropy loss of the main anchor node and the cross-entropy loss of the set of auxiliary anchor nodes, and calculate the spatial enhancement gradient of the weighted joint loss relative to the candidate edge elements in the adjacency matrix. S6. Determine the perturbation score of the candidate edge based on the magnitude of the spatial enhancement gradient, and determine the edge addition or deletion operation based on the sign of the spatial enhancement gradient and the current connection state of the candidate edge; S7. Select candidate edges from high to low according to the perturbation score and update the adjacency matrix, and repeat S4 to S7 until the iteration termination condition or structural perturbation budget is reached. S8. Output the updated perturbation graph data, perturbation adjacency matrix, or adversarial example generation results for graph neural networks.

[0013] In S1 of the above method, the graph neural network classifier is a graph convolutional network, graph attention network, or GraphSAGE model used for node classification. The graph neural network classifier outputs the predicted probability of each node belonging to each category based on the adjacency matrix and the node feature matrix.

[0014] The confidence correct boundary mentioned in S2 of the above method Calculate as follows: ,in, For nodes The maximum predicted class probability, P(ysecond|vi), is the second largest predicted class probability after the maximum predicted class. The smaller the value, the closer the node is to the decision boundary.

[0015] The hierarchical filtering in S3 of the above method includes confidence filtering, low-degree filtering, and boundary filtering; the confidence filtering retains test nodes whose confidence correct boundary is greater than the median of the test node set, thus obtaining the first node set.

[0016] The method described above, wherein the low-degree screening retains nodes in the first node set whose degree is less than the average degree of the first node set, to obtain a second node set, in order to select nodes that are more sensitive to structural disturbances.

[0017] In the method described above, the boundary filtering selects K nodes with the smallest confidence correct boundary from the second node set to form an anchor node set, where K is a preset number of anchor nodes.

[0018] The set of auxiliary anchor nodes in S4 of the method described above satisfy and ,in For the set of anchor nodes, M is the number of auxiliary anchor nodes.

[0019] The weighted joint loss in S5 of the above method includes a primary anchor node loss term and an auxiliary anchor node average loss term, with the weight of the primary anchor node loss term being... The weight of the average loss term for the auxiliary anchor node is ,in .

[0020] In the method described above, the spatial enhancement gradient is the partial derivative of the weighted joint loss with respect to the elements of the candidate edge adjacency matrix; the perturbation score is the absolute value of the spatial enhancement gradient; when the spatial enhancement gradient is greater than 0 and the candidate edge does not currently exist, an edge addition operation is performed; when the spatial enhancement gradient is less than 0 and the candidate edge currently exists, an edge deletion operation is performed.

[0021] In the method described above, the structural perturbation budget is a preset proportion of the original number of edges, and for an undirected graph, the L0 norm between the updated perturbation adjacency matrix and the original adjacency matrix does not exceed twice the structural perturbation budget.

[0022] The technical content of the present invention will be further elaborated below with examples.

[0023] Example 1: Graph Neural Network Classification and Perturbation Constraints

[0024] In this embodiment, the graph data to be processed is represented as follows: ,in For a set of nodes, Let be the set of edges. It is an adjacency matrix. This represents the node feature matrix. For node classification tasks, a graph neural network classifier... Receive A and X and output the node category probability matrix Z.

[0025] (1) in, This represents the adjacency matrix after adding self-loops. for The corresponding degree matrix, For the l-th hidden representation, Let l be the trainable weight matrix of the l-th layer. This is a non-linear activation function. This formula illustrates how graph neural networks obtain node representations through neighborhood aggregation.

[0026] (2) in, This outputs the category probabilities, where C is the number of categories. This formula is used to obtain the node prediction probabilities required for subsequent anchor node selection and joint loss calculation.

[0027] (3) in, A set of labeled nodes For nodes The true label, For nodes The predicted probability on the true class. This formula is used to train or describe a proxy graph neural network classifier.

[0028] (4) in, For the perturbation adjacency matrix, For the set of test nodes, For structural perturbation budgeting, in an undirected graph, a change in a single edge corresponds to a change in two symmetric elements in the adjacency matrix; therefore, a budget is used. As a budget constraint.

[0029] Example 2: Layered Anchor Node Screening

[0030] This embodiment first utilizes the class probabilities output by the surrogate graph neural network classifier to perform hierarchical screening of test nodes. Hierarchical screening includes confidence screening, low-degree screening, and boundary screening, with the goal of selecting anchor nodes that have both perturbation value and sensitivity to structural perturbations.

[0031] (5) in, . Represents a node The confidence correct boundary is such that the smaller the value, the closer the node is to the decision boundary.

[0032] (6) Where Median(·) is the median operator. This formula is used to select nodes from the test nodes that currently have a high confidence output from the model, forming the first node set. .

[0033] (7) in, Represents a node The degree, For the first node set The average degree. Low-degree nodes are more susceptible to changes in adjacent edges during neighborhood aggregation, therefore this step forms a structure-sensitive second set of nodes. .

[0034] (8) Where K is the number of anchor nodes. This represents the final set of anchor nodes. This formula is used to select K nodes from the second set of nodes that are closer to the decision boundary.

[0035] Example 3: Spatial Gradient Boosting and Edge Update

[0036] After obtaining the set of anchor nodes, this embodiment samples auxiliary anchor nodes for each main anchor node and uses the joint loss of the main anchor nodes and auxiliary anchor nodes to calculate the spatially enhanced gradient. Auxiliary anchor nodes are used to introduce spatial correlation between nodes, so that the edge update direction no longer depends solely on the local gradient of a single main anchor node.

[0037] (9) in, Represents the main anchor node at the t-th iteration. The corresponding set of auxiliary anchor nodes, where M is the number of auxiliary anchor nodes.

[0038] (10) in, Let be the perturbation adjacency matrix of the t-th iteration. For cross-entropy loss, For balancing parameters, This is the set of auxiliary anchor nodes. This formula is used to combine the losses of the primary anchor nodes and the average losses of the auxiliary anchor nodes.

[0039] (11) in, Candidate edges The spatial augmentation gradient corresponding to the adjacent matrix elements. After expansion, It includes the weighted sum of the cross-entropy loss gradient of the primary anchor node and the cross-entropy loss gradient of the secondary anchor node.

[0040] (12) in, Candidate edges The perturbation score is the percentage of the edge being changed. A higher score indicates a greater impact of altering the candidate edge on the graph neural network loss.

[0041] When updating, if and Then the candidate edges Add a graph structure; if and Then the candidate edge Remove from the graph structure. Each iteration follows... Candidate edges are selected from high to low for updating until the iteration termination condition or structural perturbation budget is met.

[0042] Example 4: Overall Process

[0043] Step 1: Obtain graph data Adjacency matrix Node labels Test node set Structural disturbance budget Number of anchor nodes K, number of auxiliary anchor nodes M, balance parameters Graph Neural Network Classifier .

[0044] Step 2, input A and X The node category probability matrix Z is obtained, and the CCM value of each node in the test node set is calculated according to equation (5).

[0045] Step 3: Perform confidence screening according to equation (6), low-confidence screening according to equation (7), and decision boundary screening according to equation (8) to obtain the set of anchor nodes. .

[0046] Step 4, for each main anchor node According to equation (9), M auxiliary anchor nodes are sampled to obtain the set of spatially related nodes.

[0047] Step 5: Calculate the weighted joint loss according to Equation (10), and obtain the spatial enhancement gradient of the candidate edge according to Equation (11).

[0048] Step 6: Calculate the candidate edge perturbation score according to equation (12); perform edge addition or deletion according to the gradient sign and the current adjacency matrix state.

[0049] Step 7: Repeat steps 4 through 6 until the number of iterations T or the structural perturbation budget is reached. Output disturbance map data Perturbation adjacency matrix Or the results of adversarial sample generation by a graph neural network.

[0050] Example 5: Parameter Setting and Experimental Verification

[0051] In a specific experimental implementation, the proposed method was validated using four publicly available node classification datasets: Cora, Cora-ML, Citeseer, and PubMed. These datasets contain 2485, 2810, 3327, and 19717 nodes, respectively, with feature dimensions of 1433, 2879, 3703, and 500, edge counts of 5429, 8416, 4732, and 44338, and the number of classes of 7, 7, 6, and 3, respectively.

[0052] In the experiment, approximately 20% of the nodes were labeled, and the remaining nodes were unlabeled. 50% of the unlabeled nodes were randomly sampled as the test node set. The graph neural networks tested included GCN, GAT, and GraphSAGE. The model employed a two-layer structure with ReLU activation function, Adam optimizer, a learning rate of 0.01, and a weight decay coefficient of [missing value]. Each layer of the GAT contains two attention heads. The perturbation budget is set to... Default budget factor Balance parameters The default setting is 0.5; the sampling ratio of auxiliary anchor nodes relative to the total number of anchor nodes. The default value is 0.1. The experimental hardware environment consists of an Intel Core i9-12900K processor and an NVIDIA RTX 3090 graphics card, and the software environment consists of PyTorch 1.12.1 and PyTorchGeometric 2.1.0.

[0053] The comparison methods include Random, Mettack, FGA, MGA, MGNS, and CTEA. Random randomly adds or removes edges; Mettack optimizes perturbations based on meta-learning; FGA selects edge perturbations based on adjacency matrix gradients; MGA introduces a momentum gradient mechanism; MGNS combines node gradient sensitivity and node importance; and CTEA selects hidden perturbation edges based on causal relationships.

[0054] As shown in Table 1, under the GCN model, our method achieves lower classification accuracy and higher cross-entropy loss on all four datasets, indicating that the perturbation graph generated through anchor node selection and spatial gradient enhancement can more fully expose the vulnerability of graph neural networks under structural perturbations. Taking Citeseer as an example, the accuracy on the Clean graph is 67.50%, which our method reduces to 58.61% and increases the loss to 1.88.

[0055] Table 1. Classification accuracy (Acc) and cross-entropy loss (Loss) of different methods under the GCN model.

[0056]

[0057] Further experiments show that this method also maintains good transfer performance on GAT and GraphSAGE; Figure 4 Ablation experiments showed that removing confidence screening, low-level screening, or decision boundary screening all reduced the sample generation effect. Figure 5 This indicates that removing the spatial gradient enhancement mechanism reduces the sample generation effect, suggesting that the joint loss of the auxiliary anchor nodes has an enhancing effect on the gradient direction. Figure 7 Show budget factor As the perturbation effect increases, the overall effect of each method is enhanced, and this method still maintains its advantage in low-budget scenarios. Figure 6 Display balance parameters At a value around 0.5, it can balance the requirements of the main anchor node and the spatial information of the auxiliary anchor node; Figure 7 Display auxiliary anchor node sampling ratio An excessively large value may introduce gradient redundancy, so it is preferable to set it in the range of 0.1 to 0.15.

Claims

1. A method for generating adversarial examples with spatial gradient enhancement for anchor nodes in graph neural networks, characterized in that, Includes the following steps: S1. Obtain the graph data to be processed, adjacency matrix, node feature matrix, node labels, test node set, structural perturbation budget, number of anchor nodes, number of auxiliary anchor nodes, balance parameters, and graph neural network classifier, wherein the graph data includes a node set and an edge set; S2. Input the adjacency matrix and node feature matrix into the graph neural network classifier to obtain the class probability output of the test nodes, and calculate the confidence correct boundary of each test node based on the class probability output. S3. Based on the confidence correctness boundary, node degree and decision boundary proximity, the test node set is hierarchically filtered to obtain the anchor node set; S4. For each main anchor node in the anchor node set, sample auxiliary anchor nodes from the anchor nodes other than the main anchor node to obtain an auxiliary anchor node set; S5. Construct a weighted joint loss based on the cross-entropy loss of the main anchor node and the cross-entropy loss of the set of auxiliary anchor nodes, and calculate the spatial enhancement gradient of the weighted joint loss relative to the candidate edge elements in the adjacency matrix. S6. Determine the perturbation score of the candidate edge based on the magnitude of the spatial enhancement gradient, and determine the edge addition or deletion operation based on the sign of the spatial enhancement gradient and the current connection state of the candidate edge; S7. Select candidate edges from high to low according to the perturbation score and update the adjacency matrix, and repeat S4 to S7 until the iteration termination condition or structural perturbation budget is reached. S8. Output the updated perturbation graph data, perturbation adjacency matrix, or adversarial example generation results for graph neural networks.

2. The method according to claim 1, characterized in that, The graph neural network classifier described in S1 is a graph convolutional network, graph attention network, or GraphSAGE model used for node classification. The graph neural network classifier outputs the predicted probability of each node belonging to each category based on the adjacency matrix and the node feature matrix.

3. The method according to claim 1, characterized in that, The confidence correctness boundary described in S2 Calculate as follows: ,in, For nodes The maximum predicted class probability, P(ysecond|vi), is the second largest predicted class probability after the maximum predicted class. The smaller the value, the closer the node is to the decision boundary.

4. The method according to claim 1, characterized in that, The hierarchical filtering in S3 includes confidence filtering, low-degree filtering, and boundary filtering; the confidence filtering retains test nodes whose confidence correct boundary is greater than the median of the test node set, thus obtaining the first node set.

5. The method according to claim 4, characterized in that, The low-degree screening retains nodes in the first node set whose degree is less than the average degree of the first node set, thus obtaining a second node set, in order to select nodes that are more sensitive to structural disturbances.

6. The method according to claim 5, characterized in that, The boundary filtering selects the K nodes with the smallest confidence correct boundary from the second node set to form an anchor node set, where K is the preset number of anchor nodes.

7. The method according to claim 1, characterized in that, Set of auxiliary anchor nodes in S4 satisfy and ,in For the set of anchor nodes, M is the number of auxiliary anchor nodes.

8. The method according to claim 1, characterized in that, The weighted joint loss described in S5 includes a primary anchor node loss term and an auxiliary anchor node average loss term, with the weight of the primary anchor node loss term being... The weight of the average loss term for the auxiliary anchor node is ,in .

9. The method according to claim 8, characterized in that, The spatial enhancement gradient is the partial derivative of the weighted joint loss with respect to the elements of the candidate edge adjacency matrix; the perturbation score is the absolute value of the spatial enhancement gradient. When the spatial enhancement gradient is greater than 0 and the candidate edge does not currently exist, an edge addition operation is performed; when the spatial enhancement gradient is less than 0 and the candidate edge currently exists, an edge deletion operation is performed.

10. The method according to claim 1, characterized in that, The structural perturbation budget is a preset proportion of the original number of edges, and for an undirected graph, the L0 norm between the updated perturbation adjacency matrix and the original adjacency matrix does not exceed twice the structural perturbation budget.

Images