# Dynamic Node Privacy Feature Decoupling Graph Autoencoder Based on Attention Mechanism
## 6 Simulation Results
### The Impact of Attack Model  
To investigate the impact of different attack models on privacy protection, this study implemented two common classification models--MLP and SVM, with their inference results shown in Figure 3. The experimental results demonstrate that different attack models yield varying privacy attribute inference outcomes, yet overall, MLP and SVM maintain highly consistent accuracy rates with minimal divergence. Specifically, the discrepancy between the two attack models' inference results was more pronounced in the Yale dataset compared to the Rochester dataset. Both MLP and SVM achieved a privacy attribute inference accuracy of 0.075 on graph embeddings generated by PVGAE.  
This phenomenon may stem from the distinct classification strategies employed by each attack model: SVM's performance depends on kernel function selection, while MLP utilizes different activation functions. However, their consistent overall inference performance suggests that the choice of attack model has limited influence on user privacy inference outcomes. Instead, the inherent privacy protection strength of the graph embedding technique and the complexity of different graph datasets play more dominant roles.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Model**} & \multicolumn{2}{c}{**Utility Attribute**} & \multicolumn{2}{c}{**Privacy Attribute**} \\ \cline{3-6}  & & **ACC** & **Macro-F1** & **ACC** & **Macro-F1** \\ \hline \multirow{4}{*}{Yale} & VGAE & \(0.902\pm 0.001\) & \(0.895\pm 0.001\) & \(0.867\pm 0.002\) & \(0.865\pm 0.001\) \\  & APGE & \(0.813\pm 0.001\) & \(0.780\pm 0.009\) & \(0.614\pm 0.014\) & \(0.618\pm 0.015\) \\  & PVGAE & \(0.840\pm 0.010\) & \(0.826\pm 0.002\) & \(0.740\pm 0.003\) & \(0.740\pm 0.002\) \\  & GAEMI & \(0.709\pm 0.005\) & \(0.704\pm 0.002\) & \(0.625\pm 0.010\) & \(0.636\pm 0.004\) \\  & ours & \(0.848\pm 0.001\) & \(0.839\pm 0.002\) & \(0.612\pm 0.001\) & \(0.609\pm 0.010\) \\ \hline \multirow{4}{*}{Rochester} & VGAE & \(0.873\pm 0.002\) & \(0.866\pm 0.002\) & \(0.646\pm 0.001\) & \(0.645\pm 0.001\) \\  & APGE & \(0.852\pm 0.005\) & \(0.852\pm 0.004\) & \(0.611\pm 0.005\) & \(0.606\pm 0.005\) \\  & PVGAE & \(0.830\pm 0.002\) & \(0.821\pm 0.014\) & \(0.594\pm 0.013\) & \(0.593\pm 0.004\) \\  & GAEMI & \(0.834\pm 0.011\) & \(0.826\pm 0.003\) & \(0.612\pm 0.004\) & \(0.609\pm 0.006\) \\  & ours & \(0.865\pm 0.002\) & \(0.855\pm 0.002\) & \(0.569\pm 0.004\) & \(0.575\pm 0.004\) \\ \hline \multirow{4}{*}{Credit defaulter} & VGAE & \(0.796\pm 0.002\) & \(0.638\pm 0.002\) & \(0.647\pm 0.014\) & \(0.654\pm 0.017\) \\  & APGE & \(0.785\pm 0.003\) & \(0.640\pm 0.002\) & \(0.629\pm 0.001\) & \(0.654\pm 0.001\) \\ \cline{1-1}  & PVAE & \(0.778\pm 0.003\) & \(0.621\pm 0.003\) & \(0.634\pm 0.04\) & \(0.632\pm 0.004\) \\ \cline{1-1}  & GAEMI & \(0.789\pm 0.002\) & \(0.624\pm 0.018\) & \(0.619\pm 0.002\) & \(0.612\pm 0.002\) \\ \cline{1-1}  & ours & \(0.775\pm 0.003\) & \(0.745\pm 0.003\) & \(0.610\pm 0.010\) & \(0.611\pm 0.012\) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Utility and privacy evaluation on Yale and Rochester.  
Figure 3: The impact of different attack model: (**a**) Yale. (**b**) Rochester. (**c**) Credit.  
Notably, the graph embeddings generated by our proposed method exhibited the smallest performance gap between MLP and SVM across both datasets. This indicates that our alternating training approach comprehensively evaluates each node's privacy significance while maintaining precise identification of critical privacy nodes, thereby enhancing the model's robustness and generalizability across diverse graph data