# Dynamic Node Privacy Feature Decoupling Graph Autoencoder Based on Attention Mechanism
## 6 Simulation Results
### Compared Models, Attack Model and Parameter Settings  
This study conducts a comparative analysis of four representative graph embedding models, specifically including:  
1. VGAE [21]: VGAE employs a variational autoencoder architecture that combines graph structure reconstruction loss with KL divergence by enforcing latent representations to fit a prior distribution, effectively achieving distributed learning of graph embeddings. Notably, this model does not incorporate any privacy protection mechanisms, thus providing a fundamental reference for evaluating the privacy protection efficacy of subsequent models. 2. PVGAE [20]: An enhanced version of the VGAE architecture that introduces a dual-encoder alternating training mechanism. By constructing variational independence constraints, it systematically eliminates privacy-sensitive information from embedded representations. This method achieves targeted privacy stripping while maintaining graph structure representation capabilities. 3. GAE-MI [24]: Adopts an adversarial training framework to simultaneously optimize utility performance and privacy protection objectives. Innovatively employs mutual information as the metric: by maximizing application utility mutual information while minimizing privacy leakage mutual information, it constructs a dual-objective optimization function. To improve computational efficiency, it uses variational lower bounds for approximation estimation, significantly reducing computational complexity while ensuring model performance. 4. APGE [25]: Based on the classical graph autoencoder architecture, proposes an extended layer fusion mechanism to encode privacy label information into latent space. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Nodes** & **Edges** & **Features** & **Attributes** &
\begin{tabular}{c} **Average** \\ **Degree** \\ \end{tabular} \\ \hline Yale & 8578 & 405,450 & 188 & 6 & 94.3 \\ Rochester & 4563 & 167,653 & 236 & 6 & 73.5 \\ Credit defaulter & 30,000 & 1,459,992 & 14 & 14 & 97.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Description of datasets. Figure 2: Dataset visualization: (**a**) Yale. (**b**) Rochester. (**c**) Credit defaulter. Designs a dual-path adversarial training strategy: while minimizing public label prediction error, it maximizes privacy label prediction loss through adversarial optimization, thereby achieving active obfuscation of privacy information in latent space. In summary, while VGAE serves as a baseline model with no privacy mechanisms, PVGAE, GAE-MI, and APGE each implement distinct strategies for privacy protection. PVGAE focuses on eliminating sensitivity through variational independence, GAE-MI emphasizes a balance between utility and privacy via mutual information, and APGE enhances privacy labeling through adversarial optimization. This comparative analysis highlights the varying methodologies employed to achieve privacy preservation in graph embedding frameworks. This study employs attribute inference attacks as the attack model. Attribute inference attacks aim to analyze publicly available or accessible data, such as published graph embeddings and partial users' privacy attributes, by training a classifier to infer undisclosed private attributes of target individuals or data, constituting privacy infringement methods for attributes like age, gender, location, etc. For the Yale dataset, class year is selected as the privacy attribute and student/faculty status as the utility attribute; for Rochester, gender is treated as the privacy attribute while class year serves as the utility attribute. In Credit defaulter dataset, we will infer whether a user will default on a credit card payment as a public attribute and consider an individual's marital status as private attribute. Additionally, for link prediction, this study randomly samples 10% of links as the test set and 10% as negative edges. For node classification tasks, 20% of nodes are randomly selected as the test set.