arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2310.09800cs.LGcs.CV
收藏

同质与异质图神经网络上的模型反演攻击

Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks

Yunnan University(云南大学);University of Electronic Science and Technology of China(电子科技大学);Nanyang Technological University(南洋理工大学)

Renyang Liu, Wei Zhou, Jinhong Zhang, Xiaoyuan Liu, Peiyuan Si, Haoran Li

AI总结:

针对同质和异质图神经网络,提出基于梯度下降的模型反演攻击方法HomoGMI和HeteGMI,通过最大化交叉熵损失和邻近性重建训练图,首次实现异质图上的攻击,实验性能优于现有方法。

摘要:

近年来,图神经网络(GNNs),包括同质图神经网络(HomoGNNs)和异质图神经网络(HeteGNNs),在许多物理场景中取得了显著进展,尤其是在通信应用中。尽管取得了巨大成功,这类模型的隐私问题也受到了广泛关注。先前的研究表明,给定一个拟合良好的目标GNN,攻击者可以通过模型反演攻击重建该模型的敏感训练图,这给AI服务提供商带来了严重的隐私担忧。我们认为,这种脆弱性源于目标GNN本身以及关于现实世界图中共享属性的先验知识。受此启发,我们提出了一种针对HomoGNNs和HeteGNNs的新型模型反演攻击方法,即HomoGMI和HeteGMI。具体来说,HomoGMI和HeteGMI是基于梯度下降的优化方法,旨在最大化目标GNN上的交叉熵损失以及重建图上的一阶和二阶邻近性。值得注意的是,据我们所知,HeteGMI是首次尝试对HeteGNNs进行模型反演攻击。在多个基准上的大量实验表明,所提出的方法能够取得优于竞争方法的性能。

英文摘要:

Recently, Graph Neural Networks (GNNs), including Homogeneous Graph Neural Networks (HomoGNNs) and Heterogeneous Graph Neural Networks (HeteGNNs), have made remarkable progress in many physical scenarios, especially in communication applications. Despite achieving great success, the privacy issue of such models has also received considerable attention. Previous studies have shown that given a well-fitted target GNN, the attacker can reconstruct the sensitive training graph of this model via model inversion attacks, leading to significant privacy worries for the AI service provider. We advocate that the vulnerability comes from the target GNN itself and the prior knowledge about the shared properties in real-world graphs. Inspired by this, we propose a novel model inversion attack method on HomoGNNs and HeteGNNs, namely HomoGMI and HeteGMI. Specifically, HomoGMI and HeteGMI are gradient-descent-based optimization methods that aim to maximize the cross-entropy loss on the target GNN and the $1^{st}$ and $2^{nd}$-order proximities on the reconstructed graph. Notably, to the best of our knowledge, HeteGMI is the first attempt to perform model inversion attacks on HeteGNNs. Extensive experiments on multiple benchmarks demonstrate that the proposed method can achieve better performance than the competitors.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑