GRID通过加噪保护图神经网络训练图的边关系,防窃取且不损失预测精度。
GRID: Protecting Training Graph from Link Stealing Attacks on GNN Models
- 对关键节点的预测向量添加精心设计噪声,伪装邻接关系为非直接连接。
- 在5个数据集上验证,可有效抵御多种链路窃取攻击,保持模型准确率不变。
- 仅对核心节点加噪,兼顾隐私保护与计算效率,适合实际部署于图模型。
图神经网络(GNN)在图结构数据分类任务中表现优异,但面临链路窃取攻击威胁:攻击者可通过测量节点预测向量的相似性推断两节点间是否存在边。此类攻击严重危害训练图的隐私与安全。本文提出新型防御方案Graph Link Disguise(GRID),在保证模型预测准确性前提下提供形式化保障。GRID的核心思想是向节点预测向量添加精心设计的噪声,使相邻节点的预测向量相似度被伪装为非邻接节点水平。算法结合图拓扑,仅选择覆盖所有边的子集节点(核心节点)加噪,避免噪声抵消,同时降低失真和计算开销。所加噪声确保:1)任意两个相邻节点的噪声后向量相似度等于非相邻节点;2)模型预测结果不变,实现零效用损失。在五个数据集上的大量实验表明,该方法在归纳与直推设置下均能有效防御多种代表性链路窃取攻击及基于影响的攻击。相比现有方法,其在隐私-效用权衡上表现更优。
原文摘要 · Abstract (English)
Graph neural networks (GNNs) have exhibited superior performance in various classification tasks on graph-structured data. However, they encounter the potential vulnerability from the link stealing attacks, which can infer the presence of a link between two nodes via measuring the similarity of its incident nodes' prediction vectors produced by a GNN model. Such attacks pose severe security and privacy threats to the training graph used in GNN models. In this work, we propose a novel solution, called Graph Link Disguise (GRID), to defend against link stealing attacks with the formal guarantee of GNN model utility for retaining prediction accuracy. The key idea of GRID is to add carefully crafted noises to the nodes' prediction vectors for disguising adjacent nodes as n-hop indirect neighboring nodes. We take into account the graph topology and select only a subset of nodes (called core nodes) covering all links for adding noises, which can avert the noises offset and have the further advantages of reducing both the distortion loss and the computation cost. Our crafted noises can ensure 1) the noisy prediction vectors of any two adjacent nodes have their similarity level like that of two non-adjacent nodes and 2) the model prediction is unchanged to ensure zero utility loss. Extensive experiments on five datasets are conducted to show the effectiveness of our proposed GRID solution against different representative link-stealing attacks under transductive settings and inductive settings respectively, as well as two influence-based attacks. Meanwhile, it achieves a much better privacy-utility trade-off than existing methods when extended to GNNs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。