CN115809698A - Black box escape map injection attack method for map neural network - Google Patents

Abstract

The invention discloses a black-box escape graph injection attack method for graph neural network, which comprises the following steps: step 1: obtaining proxy graph data set G _sur ; step 2: training proxy model f _sur ; step 3: obtaining original victim Graph dataset G; Step 4: Use the proxy model f _sur to generate a label set L for the original victim graph dataset G; Step 5: Calculate the candidate neighbor node set V _nei of the injected node set V _inj ; Step 6: Build the injected node set The nodes in V _inj are topologically connected with the original victim graph dataset G; step seven: adaptively optimize the features X _inj of the injected nodes; step eight: attack the victim model f _vit . This method can guarantee the attack performance and attack concealment, and improve the attacker's attack performance on the node classification task of the graph neural network model.

Description

Black-box escape graph injection attack method for graph neural network

technical field

The invention relates to the technical field of deep learning, in particular to a black-box escape graph injection attack method for a graph neural network.

Background technique

A graph is a non-Euclidean data structure composed of nodes and their connections, and has the ability to represent complex coupling relationships. Many real-life scenarios can be modeled with graph structures, such as social platforms, transportation systems, recommendation systems, and financial risk assessment systems, etc. The deep learning model has a strong learning ability and has been widely studied in the fields of natural language processing and computer vision. However, due to the specific non-Euclidean data nature of the graph, the traditional Euclidean data deep learning model is difficult to process graph-structured data. underperformed. Therefore, a lot of work is devoted to better developing Graph Neural Networks (GNNs for short) to effectively integrate the node characteristics and topology information of graph data, and capture the potential data flow between nodes.

Although graph neural networks have made good progress, they are vulnerable to adversarial attacks, that is, small but well-designed perturbations can lead to a large performance degradation of graph neural network models. A lot of previous work has been devoted to the study of Graph Modification Attacks (Graph Modification Attacks, referred to as GMA), trying to mislead the prediction of the graph neural network model by adding small perturbations to the existing nodes or topology in the graph, such as different types of nodes Add malicious edges between them, or tamper with some node attributes, etc. However, in many real-world scenarios, modifying the data in the original graph often requires extremely high operating authority, so more and more people are paying attention to the Graph Injection Attack (GIA for short), which is more suitable for display scenarios, that is, the attacker The attack is carried out by generating a small number of malicious nodes and establishing connections with nodes in the original graph. For example, tampering with existing users' comments in social networks requires higher authority, but it is relatively simple to register a new user to post malicious remarks to guide public opinion. However, the current research on graph injection attack methods is still in its infancy, and it is usually difficult for attackers to balance attack performance and its own concealment at the same time.

Therefore, there is a need for a black-box escape graph injection attack method for graph neural networks, which allows attackers to inject malicious nodes in a targeted manner according to the topology and node characteristics of graph data in the black-box test phase, while optimizing the characteristics of malicious nodes. At the same time, its concealment is improved, so as to take into account the destructiveness and concealment of the attacker, and improve the attack performance of the attacker on the node classification task of the graph neural network model.

Contents of the invention

The purpose of the present invention is to provide a black box escape graph injection attack method for the graph neural network, which can guarantee attack performance and Attack concealment, improve the attacker's attack performance on the node classification task of the graph neural network model.

The technical scheme that realizes the object of the present invention is:

A black-box escape graph injection attack method for a graph neural network includes the following steps:

Step 1: Obtain the proxy graph data set G _sur , obtain the proxy graph data set G _sur from the crowdsourcing platform channel = (V _sur , E _sur , X _sur , L _sur ), where V _sur is a node set, representing the graph data set G _sur All the nodes in , E _sur is the edge set, indicating all the edges existing between nodes, X _sur is the feature matrix obtained by concatenating all the features of the node set V _sur , L _sur is the node corresponding to each node in the node set V _sur A label set composed of labels;

Step 2: Train the proxy model f _sur , select a representative graph neural network model as the proxy model f _sur , and then train f _sur on the proxy dataset G _sur until it converges;

Step 3: Obtain the original victim graph dataset G, and obtain the original victim graph dataset G=(V, E, X, L) from the crowdsourcing platform channel according to the attack target, where V is a node set, representing the graph dataset G All the nodes in , E is the edge set, which means all the edges between the nodes, X is the feature matrix obtained by concatenating all the features of the node set V, and L is the label set composed of the labels corresponding to each node in the node set V , because the label set L in the original victim map dataset G cannot be obtained under the black box setting, so L is an empty set in the initial state;

Step 4: Use the proxy model f _sur to generate a label set L for the original victim graph dataset G. Since the label set L in the original victim graph dataset G cannot be obtained under the black box setting, it is necessary to use a converged proxy model f _sur predicts the labels of all nodes in the original victim graph dataset G, and uses the labels predicted by f _sur as the label set L;

Step 5: Calculate the candidate neighbor node set V _nei of the injected node set V _inj , according to the topology structure and node attributes in the original victim graph data set G, calculate the information domain of the node, namely ID and classification interval, namely CM, according to ID and CM Calculate the final node anti-vulnerability (AF), and select the node with greater anti-vulnerability in G as the candidate neighbor node set V _nei of the injected node;

Step 6: Construct the topological connection between the nodes in the injected node set V _inj and the original victim graph data set G. After determining the candidate set V _nei , based on the noise category of the nodes in V _nei and the edge attack budget E _inj of the injected nodes, Further fine-grained division of the candidate node set V _nei , the E _inj nodes of the same noise class are divided into a cluster, and each cluster is regarded as a candidate neighbor set of an injected node. In order to enhance the concealment of the injected node, the candidate neighbor node set V The nodes in _nei can only be used as candidate neighbors for an injected node;

Step 7: Adaptively optimize the feature X _inj of the injected node, use the C&W loss to optimize the feature of the injected node, and restrict the optimized feature of the injected node to ensure that the feature of the injected node does not exceed the scope of the original feature domain, and the features of the injected node After the optimization is completed, the perturbation graph G _per including the injected nodes is obtained;

Step 8: Attack the victim model f _vit . In the test phase without changing the model parameters of the victim model f _vit , the victim model f _vit takes the perturbation graph G _per as input and executes downstream tasks.

The advantages or beneficial effects of this technical solution:

1. This technical solution uses the strategy of injecting malicious nodes to attack the graph neural network without modifying the existing node attributes or topology features in the original graph. This attack technology is closer to the real scene;

2. This technical solution fully considers the harmfulness and concealment of the attack in the topology construction and feature optimization process of the injection node. When attacking the graph neural network model with certain defensive capabilities, the attack performance is significantly better than the existing attack baseline model.

3. This technical solution reduces the search space for subsequent operations through the anti-vulnerability of computing nodes, saves time and space resource consumption, and enables attacks to be applied to large-scale graph scenarios;

This method can improve the attack concealment of the graph neural network and obtain better attack accuracy.

Description of drawings

Fig. 1 is the flowchart of embodiment.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and specific embodiments, but the present invention is not limited thereto.

Example:

Social platforms are one of the most frequently contacted networks in the information age. Due to the wide audience and fast information dissemination of social platforms, the information on social platforms has a great influence on the guidance of public opinion and the construction of social values. . The social platform based on the graph neural network can use the user characteristic information and the attention relationship between users to build a social platform user relationship network, effectively integrate the user characteristics and attention relationship of social platform data, and capture the potential data flow between users.

Taking the social platform based on the graph neural network as an example, through this example, the attacker can inject a small number of malicious users on the social platform to reduce the data mining performance of the graph neural network on the social platform.

Referring to Figure 1, the black-box escape graph injection attack method for graph neural network includes the following steps:

Step 1: Obtain the user relationship graph data set G _sur of the agent social platform, and obtain the agent graph data set G _sur = (V _sur , E _sur , X _sur , L _sur ) from crowdsourcing platforms and other channels, where V _sur is a node set, representing All the users in the graph data set G _sur , E _sur is the edge set, which represents the attention relationship between users, X _sur is the feature matrix obtained by concatenating all user features of the node set V _sur , L _sur is the node set V _sur A label set composed of labels corresponding to each node;

Step 2: Train the proxy model f _sur : select a representative graph neural network model as the proxy model f _sur , such as graph convolutional network GCN or graph attention network GAT and other graph neural network models, and divide the proxy dataset G _sur into For the training set, verification set and test set, then train f _sur on the proxy dataset G _sur until it converges;

Step 3: Obtain the original victim social platform user relationship graph dataset G, and obtain the original victim social platform user relationship graph dataset G=(V, E, X, L) from channels such as crowdsourcing platforms according to the attack target, where V is the node set, representing all users in G, E is the edge set, representing the attention relationship between users, x is the feature matrix obtained by concatenating all user features of node set V, L is each node in node set V The label set composed of corresponding labels, because the label set L in the original victim map data set G cannot be obtained under the black box setting, so L is an empty set in the initial state;

Step 4: Use the proxy model f _sur to generate a label set L for the original victim social platform user relationship graph dataset G. Since the label set L in the original victim social platform user relationship graph dataset G cannot be obtained under the black box setting, Therefore, it is necessary to use the converged proxy model f _sur to predict the class probabilities of all nodes in the original victim social platform user relationship graph dataset G, and use the category with the largest probability value predicted by f _sur as the pseudo-label of the node, and the pseudo-label of all nodes Label set as label set L;

Step 5: Calculate the candidate neighbor node set V _nei of the injected node set V _inj , and calculate the information domain of the user node, which is ID, and the classification interval, which is CM, according to the following relationship and user characteristics in the original victim social platform user relationship graph dataset G and anti-fragility or AF;

The information domain ID of user node v is defined as the product of the number of its k-order neighbors, which is formalized as:

是节点第k阶关注者的个数，用户节点的信息域可以度量节点从其他用户接收信息的能力，用户节点v的分类间隔CM定义为正确的类别对应的概率，跟其他类别中最大的概率的差，形式化为：in

is the number of followers of the k-th order of the node. The information field of the user node can measure the ability of the node to receive information from other users. The classification interval CM of the user node v is defined as the probability corresponding to the correct category, and the largest probability in other categories The difference of , formalized as:

表示代理模型预测的用户节点属于y_i类的概率，y_t是代理模型预测的用户节点伪标签，根据用户节点的信息域及其分类间隔可以计算最终的用户节点对抗脆弱性AF，形式化为：in

Indicates the probability that the user node predicted by the proxy model belongs to the category y _i , and y _t is the pseudo-label of the user node predicted by the proxy model. According to the information domain of the user node and its classification interval, the final user node anti-vulnerability AF can be calculated, which is formalized as :

After calculating the anti-vulnerability AF of all user nodes in the original victim social platform user relationship graph dataset G, sort the nodes in ascending order according to AF, and select the user nodes with the greatest anti-vulnerability to join the set of candidate neighbor nodes injected into the user node V _nei , until the attack budget is satisfied, the final candidate neighbor node set V _nei can be obtained;

Step 6: Construct the attention relationship between the user nodes in the injected user node set V _inj and the original victim social platform user relationship graph data set G, after determining the candidate neighbor node set V _nei , based on the noise category of the nodes in V _nei and the injected The node’s edge attack budget E _inj further fine-grainedly divides the candidate node set V _nei , divides E _inj nodes of the same noise class into a cluster, and each cluster is regarded as a set of candidate neighbors injected into the user node. Specifically, Use the best error class c′ predicted by the surrogate model f _sur as the grouping basis, namely:

Group nodes with the same best error class into the same cluster, in order to enhance the concealment of injected user nodes, nodes in the candidate neighbor node set V _nei can only be used as a candidate neighbor for injected user nodes;

Step 7: Adaptively optimize the feature X _inj injected into the user node, and use the C&W loss to optimize the feature injected into the user node, formalized as:

Then use min-max normalization to scale the optimized injected user node features to ensure that the injected user node features do not exceed the range of the original feature domain, formalized as:

Among them, MAX is the maximum value of the original feature field, MIN is the minimum value of the original feature field, x _max is the maximum value of the optimized malicious node, x _min is the minimum value of the optimized malicious node, normalized by min-max , the feature of the malicious user does not exceed the maximum or minimum value of the original feature, thereby further ensuring its concealment; after the feature optimization of the injected user node is completed, the social platform user relationship disturbance graph G _per including the injected user node is obtained;

Step 8: Attack the social platform model f _vit based on the graph neural network. In the test phase without changing the model parameters of the social platform model f _vit based on the graph neural network, f _vit uses the social platform user relationship disturbance graph G _per as Input and execute downstream tasks such as information mining, that is, to complete the black box escape graph injection attack.

Claims (1)

1. The black box escape map injection attack method for the neural network of the map is characterized by comprising the following steps of:

the method comprises the following steps: obtaining a proxy graph data set G _sur Obtaining an agent graph data set G from a crowdsourcing platform channel _sur ＝(V _sur ,E _sur ,X _sur ,L _sur ) In which V is _sur Representing graph data set G for a set of nodes _sur All nodes in (E) _sur Is a set of edges, X, representing all edges that exist between nodes _sur Is a node set V _sur Is obtained by splicing all the features of (1) to obtain a feature matrix, L _sur Is a node set V _sur A label set consisting of labels corresponding to each node in the node;

step two: training agent model f _sur Selecting a representative graph neural network model as a proxy model f _sur Then generation is carried outSet of physical data G _sur Training f _sur Until convergence;

step three: acquiring an original victim graph data set G, and acquiring an original victim graph data set G = (V, E, X, L) from a crowdsourcing platform channel according to an attack target, wherein V is a node set and represents all nodes in the graph data set G, E is an edge set and represents all edges existing among the nodes, X is a feature matrix obtained by splicing all features of the node set V, and L is a label set formed by labels corresponding to all nodes in the node set V;

step four: using a proxy model f _sur Generating a label set L for the original victim graph data set G, wherein the label set L in the original victim graph data set G cannot be obtained under the black box setting, so that the converged proxy model f needs to be used _sur Predict labels of all nodes in the original victim graph dataset G and assign f _sur The predicted label is used as a label set L;

step five: compute injection node set V _inj Candidate neighbor node set V _nei According to the topological structure and node attributes in an original victim graph data set G, calculating an Information Domain (ID) and a Classification interval (CM) of a node, calculating the final node anti-vulnerability (AF) according to the ID and the CM, and selecting the node with higher anti-vulnerability in the G as a candidate neighbor node set V of an injection node _nei ；

Step six: constructing injection node set V _inj Is topologically connected with the original victim graph data set G, and a candidate set V is determined _nei Then based on V _nei Noise class of middle node and edge attack budget E of injection node _inj Further fine-grained partitioning of candidate node set V _nei The same noise class E _inj Each node is divided into a cluster, each cluster is regarded as a candidate neighbor set of an injection node, and in order to enhance the concealment of the injection node, a candidate neighbor node set V _nei The node in (2) can only be used as a candidate neighbor of an injection node;

step seven: feature X of adaptively optimizing injection nodes _inj Application of C&W loss optimization of the characteristics of the injection nodes, and limitation of the optimized characteristics of the injection nodes to ensure that the characteristics of the injection nodes do not exceed the range of the original characteristic domain, and obtaining a disturbance graph G containing the injection nodes after the optimization of the characteristics of the injection nodes is completed _per ；

Step eight: attack victim model f _vit In the test phase without changing the victim model f _vit In the case of model parameters of (2), the victim model f _vit Will disturb picture G _per As input and perform downstream tasks.

Images