[论文解读] Differentially Private Decoupled Graph Convolutions for Multigranular Topology Protection

Eli Chien, Weining Chen+4 more|arXiv (Cornell University)|Jul 12, 2023

Privacy-Preserving Technologies in Data被引用 5

一句话总结

本文提出了一种新型框架——差分私有解耦图卷积（DPDGC），用于图神经网络（GNNs）中的多粒度拓扑隐私保护。通过解耦节点特征与拓扑聚合，并引入k-邻居级别邻接关系的概念，DPDGC在隐私-效用权衡方面优于标准的DP-GNNs，尤其在图结构与节点属性具有不同隐私需求时表现更优。

ABSTRACT

GNNs can inadvertently expose sensitive user information and interactions through their model predictions. To address these privacy concerns, Differential Privacy (DP) protocols are employed to control the trade-off between provable privacy protection and model utility. Applying standard DP approaches to GNNs directly is not advisable due to two main reasons. First, the prediction of node labels, which relies on neighboring node attributes through graph convolutions, can lead to privacy leakage. Second, in practical applications, the privacy requirements for node attributes and graph topology may differ. In the latter setting, existing DP-GNN models fail to provide multigranular trade-offs between graph topology privacy, node attribute privacy, and GNN utility. To address both limitations, we propose a new framework termed Graph Differential Privacy (GDP), specifically tailored to graph learning. GDP ensures both provably private model parameters as well as private predictions. Additionally, we describe a novel unified notion of graph dataset adjacency to analyze the properties of GDP for different levels of graph topology privacy. Our findings reveal that DP-GNNs, which rely on graph convolutions, not only fail to meet the requirements for multigranular graph topology privacy but also necessitate the injection of DP noise that scales at least linearly with the maximum node degree. In contrast, our proposed Differentially Private Decoupled Graph Convolutions (DPDGCs) represent a more flexible and efficient alternative to graph convolutions that still provides the necessary guarantees of GDP. To validate our approach, we conducted extensive experiments on seven node classification benchmarking and illustrative synthetic datasets. The results demonstrate that DPDGCs significantly outperform existing DP-GNNs in terms of privacy-utility trade-offs.

研究动机与目标

• 解决现有DP-GNN中缺乏多粒度隐私保护的问题，其中节点属性与图拓扑通常需要不同的隐私级别。
• 形式化一种新的图数据集邻接关系概念——k-邻居级别邻接，以实现对拓扑隐私的灵活、细粒度控制。
• 提出图差分隐私（GDP），以确保模型参数与节点预测均满足差分隐私。
• 克服标准图卷积的局限性，后者无法支持多粒度隐私，且噪声规模随最大节点度线性增长。
• 设计并评估DPDGC，作为在差分隐私约束下比标准GNN更高效、更私有的替代方案。

提出的方法

• 提出统一的k-邻居级别邻接定义，该定义泛化了边级与节点级邻接，支持多粒度拓扑隐私。
• 提出图差分隐私（GDP），以形式化保证模型权重与节点预测的差分隐私。
• 将图卷积解耦为两个阶段：(1) 节点特征聚合，(2) 拓扑感知消息传递，从而减少结构信息带来的隐私泄露。
• 通过基于k-邻居级别邻接关系校准的噪声注入，对解耦组件应用差分隐私，避免噪声随节点度线性增长。
• 设计DPDGC模型，将节点嵌入与特征拼接以进行最终预测，确保隐私性的同时保留模型效用。
• 采用统一的GDP分析框架，推导出同时考虑属性与拓扑隐私在不同粒度下的隐私边界。

Figure 1: Top: (a) Illustration of a training graph dataset. In the example, the graph involves $6$ nodes and does not contain self-loops. Nodes $5$ and $6$ are left unlabeled in the training dataset $\mathcal{D}$ . (b) An illustration of our novel notion of $k$ -neighbor-level graph dataset adjacen

实验结果

研究问题

• RQ1 统一的图数据集邻接关系概念是否能够支持GNN中节点属性与图拓扑的多粒度隐私保护？
• RQ2 标准图卷积是否本质上无法在差分隐私下支持灵活的隐私-效用权衡？
• RQ3 在相同隐私预算下，解耦图卷积是否能相比标准GNN减少噪声需求？
• RQ4 k-邻居级别邻接参数如何影响图学习中的隐私-效用权衡？
• RQ5 所提出的DPDGC框架是否在多种基准测试中均优于现有DP-GNN，在准确率与隐私保障方面表现更优？

主要发现

• 基于图卷积的标准DP-GNN无法支持多粒度拓扑隐私，且需要随最大节点度线性增长的DP噪声。
• 所提出的k-邻居级别邻接关系实现了对拓扑隐私的灵活、参数化控制，支持在隐私强度与模型效用之间进行权衡。
• DPDGC在七个节点分类基准上达到最先进性能，在Cora数据集上，于边级GDP与ε=1条件下，准确率比GAP与DP-MLP最高提升11.3%。
• 在Facebook数据集上，DPDGC在强隐私约束下仍保持高模型效用，于边级GDP与ε=1条件下达到88.59%准确率，显著优于RandEdge+SAGE（46.42%）与DP-SAGE（31.41%）。
• 在cSBM合成实验中，当图结构具有信息量（|ϕ|较大）时，DPDGC超越DP-MLP，证明其能有效利用拓扑信息同时保持隐私。
• 在所有评估设置下，DPDGC在相近隐私预算下均取得最高准确率，证实其在隐私与效用之间平衡的高效性与有效性。

Figure 2: Illustration of the GAP and DPDGC (top) architectures and their corresponding information flow (bottom). Green modules indicate DP-MLPs trained with a DP-optimizer [ 14 ] . Blue modules are non-trainable modules. We use red frames to point to designs with DP guarantees (i.e., DP-Emb and PM