A General Black-box Adversarial Attack on Graph-based Fake News Detectors
Peican Zhu Zechen Pan Yang Liu Jiwei Tian Keke Tang Zhen Wang


DVF: Advancing Robust and Accurate Fine-Grained Image Retrieval with Retrieval Guidelines
    Zechao Li
    April 29, 2024
=========================================================================================




Graph Neural Network (GNN)-based fake news detectors apply various methods to construct graphs, aiming to learn distinctive news embeddings for classification. Since the construction details are unknown for attackers in a black-box scenario, it is unrealistic to conduct the classical adversarial attacks that require a specific adjacency matrix. In this paper, we propose the first general black-box adversarial attack framework, i.e., General Attack via Fake Social Interaction (GAFSI), against detectors based on different graph structures. Specifically, as sharing is an important social interaction for GNN-based fake news detectors to construct the graph, we simulate sharing behaviors to fool the detectors. Firstly, we propose a fraudster selection module to select engaged users leveraging local and global information. In addition, a post injection module guides the selected users to create shared relations by sending posts. The sharing records will be added to the social context, leading to a general attack against different detectors. Experimental results on empirical datasets demonstrate the effectiveness of GAFSI.








§ INTRODUCTION






The rapid expansion of online social media platforms has led to a rise in misinformation, undermining public trust in truth and science. Unlike traditional media, where content is often rigorously fact-checked, the interactive nature of social media accelerates the spread of fake news through commenting and sharing, magnifying its impact. This makes detecting and countering fake news on these platforms both challenging and crucial <cit.>.


To tackle this challenge, abundant machine-learning methods are proposed for fake news detection. Besides utilizing single-modal or multi-modal detectors to extract features from content <cit.>, there is a growing interest in conceptualizing the online social network as a graph structure to leverage the rich social context <cit.>. Among existing studies, the user-news bipartite graph is commonly used for detectors to model user engagement <cit.>. Besides, the news engagement graph can be constructed to explore relations between news directly <cit.>. Instead of capturing information in the global network, the news's local propagation structure is also investigated. The news-post propagation and dispersion tree <cit.> are constructed to aggregate information from two directions, while the news-user propagation tree <cit.> is constructed to capture user-aware in the propagation structure. Due to the diversity of the graph construction, Graph Neural Network (GNN) is allowed to learn distinctive news embeddings from different perspectives for news classification. Despite their effectiveness in detecting fake news, these detectors have increasingly been found to be vulnerable to adversarial attacks <cit.>. This vulnerability may be utilized to manipulate public opinion or gain financial benefits. Therefore, it is critical to investigate adversarial attacks on GNN-based fake news detectors to assess and enhance their robustness.



Existing adversarial attacks on GNN are primarily categorized into two types: edge perturbation and node injection. Edge perturbation techniques aim to alter the model's prediction by adding or removing edges in the graph <cit.>, while node injection approaches focus on generating and introducing malicious nodes into the graph <cit.>. Although these methods show promise when the target graph is exposed, their efficacy diminishes in a more realistic black-box setting where the graph construction process is unknown. Given the vast differences in fake news detectors based on various social network structures, assuming a certain graph to conduct attacks becomes impractical for attackers. This situation leads to a crucial question: Is it possible to develop a universal attack strategy that remains effective in a black-box scenario against fake news detectors based on diverse social network structures?



In this paper, we propose a General Attack via Fake Social Interaction (GAFSI) against GNN-based fake news detectors, aiming to alter the prediction of the target news. Unlike existing studies, that are concentrated on a certain graph, we attempt to add social interaction records into the social context and thus can influence the graph representation regardless of the construction methods. 
Specifically, we employ a fraudster selection module to identify influential fraudsters for creating fraudster-post pairs. Then, through a post injection module, we select the source of new posts in the propagation structure and clone content from existing posts to new ones. Accordingly, the selected fraudsters will send the posts to simulate social interactions. This integration of social interaction records can effectively perturb the social context and fool GNN-based fake news detectors. We validate our framework's effectiveness in attacking various GNN-based fake news detectors with different graph structures. Our extensive experimental results demonstrate that GAFSI is general and capable of deceiving different detectors in a black-box setting, outperforming state-of-the-art methods.


Overall, our contribution is summarized as follows:


  * We propose a general black-box attack framework to simulate social interactions, enhancing the effectiveness of the perturbation in a more realistic scenario. 




  * We propose GAFSI which leveraging gradient-based attention information, consists of a fraudster selection module and a post injection module.


  * Extensive experimental results demonstrate that the perturbation generated by GAFSI on social context can effectively change the prediction of the target news. 






§ RELATED WORK





 §.§ GNN-based Fake News Detection


According to the graph prototypes, GNN-based fake news detectors are primarily categorized into two types: propagation-based detectors and social-context-based detectors <cit.>. The propagation-based detectors employ a tree-structured graph to model the propagation process of a single news <cit.>. Here, the root node represents a news article and other nodes represent associated posts, while edges depict shared relations among nodes. Besides, social-context-based detectors prefer to capture global information. Recent work <cit.> considers the relations among publishers, news, and users to construct the social context graph. Su et al. Su:usdefake2023 construct a dual-layer graph that contains a news propagation layer and a user interaction layer. They use shared relations to connect the two layers. Wu and Hooi Wu:decor2023 construct a news engagement graph based on the number of common users. Although some methods utilize additional information to construct the graph, it is worth noting that shared relation remains a key factor in those graph construction processes. Hence, it inspired us to fool the GNN-based fake news detector via fake social interaction.



 §.§ Adversarial Attack on GNN


Numerous adversarial attack methods have been proposed to fool classifiers in various domains <cit.>. For graph-related tasks, the attack techniques include attribute perturbation, edge perturbation, and node injection <cit.>. Zügner et al. Zügner:nettack2018 first conduct targeted attacks on GNN through greedy-based edge perturbation. To address the inefficiency of the previous methods on large-scale graphs, Li et al. Li:sga2021 introduce a method containing a subgraph constructing process. Zhang et al. Zhang:mibtack2023 focus on finding a minimized set of perturbations to realize an attack with low cost. Recent work <cit.> start to conduct edge perturbation on heterogeneous graphs. They consider that all GNNs take the same graph as input and focus on perturbing the edge that has a larger common weight. Instead of edge perturbation, Tao et al. Tao:gnia2021 propose a targeted attack method by injecting a single node which is obtained from a pre-trained encoder. Wang et al. Wang:clusterattack2022 regard the node injection attack as a graph clustering problem and solved it based on Euclid’s distance between nodes' adversarial feature. Although existing attacks perform well in traditional graph tasks, they demonstrate limitations when attacking GNN-based fake news detectors. The edge perturbation method may break the chain, leading to the destruction of the propagation structure, which is easy to discover. Furthermore, the node injection method generates perturbation in the form of embedding which can not be restored to original attributes. Hence, they are insufficient to conduct attacks against fake news detectors. 

Wang et al. Wang:marl2023 is the first to attack GNN-based fake news detectors, focusing on manipulating three types of fraudsters to collaborate in deceiving the detector. They formulate the attack problem as attacking GNNs on a user-news bipartite graph and successfully alter the predicted label of the target news. However, they only consider modifying the edge between fraudsters and target news in the user-news bipartite graph. Thus, similar to previous attacks, their method can not attack detectors based on other graph structures. 





§ PRELIMINARY AND PROBLEM STATEMENT







  
Social Context in News Dissemination.
The social context in news dissemination is represented as G=(U, Q, P, E), where U=(u_1,…,u_m) indicates a set of m users, Q=(q_1, …,q_n) denotes a set of n news, P=(p_1, …,p_l) represents a set of l posts, E={E_u,E_t} represents a set of relation in G. Here, E_u characterizes the user-post relations, with an edge (u_i,p_j)∈ E_u signifying that user u_i is the author of post p_j. E_t characterizes a set of the shared relations between news and posts, as well as the shared relations among posts themselves. Then, the fake news detection task based on G can be treated as a binary classification problem. y_i∈ Y is the ground-truth label of the news i where 0 and 1 represent the real news and fake ones respectively.





  
Graph Construction of G for Fake News Detection.
To mine rich information in social context G, GNN-based fake news detectors typically consider the entities and relations that can represent a kind of structural pattern to construct a graph. As there are abundant structural patterns in the social context, the graph constructed by different detectors encompasses a variety of types, e.g., the user-news bipartite graph <cit.>, the news engagement graph <cit.>, the news-user propagation tree <cit.>, and the news-post propagation and dispersion tree <cit.>. For simplicity, we describe the graph construction process as:

    G_s = r(G),

where r(·) is a function to generate a graph based on social context. After constructing the graph, detectors will utilize a pre-trained language model, e.g., GloVe <cit.> and BERT <cit.>, to generate the feature matrix X and employ a GNN to learn news embedding, aiming to classify news.






  
Adversarial Attack on Specific Graph.
Existing adversarial attack methods can easily perturb the graph by adding a small perturbation ξ to the graph G_s. Here, the attack process can be described as:

    G^'_s = G_s + ξ.

However, different detectors employ different functions to generate the graph, and thus attackers need to deal with a set of Graphs {G_s^1, …, G_s^k} where k is the number of the detectors. Due to structural differences, perturbation ξ is not general for the graphs in the set. In a black-box manner, the problem will become more challenging, thereby encouraging us to develop a general approach to attack the detectors.






  
Our Attack on Social Context.
To execute a generalized attack against GNN-based fake news detectors, a natural way is to perturb the social context G instead of G_s. Therefore, a general attack process can be described as:

    G^' = G + ξ.

However, the small perturbation ξ may disrupt the semantic integrity, making attacks more easily detectable. Hence, we attempt to simulate social interaction to meet practical constraints. Specifically, we manipulate a set of controllable fraudsters U_c to add social interaction records through sharing. The perturbed social context can be represented as:

    G^'=(U, Q, P ∪ P^', E∪ E^'_u ∪ E^'_t),

where P^' includes new posts sent by fraudsters, E^'_u and E^'_t are new user-post and shared relations, respectively. The attack's objective for the k-th news q_k is formalized as:

    max_P^',E^'𝕀(max_zf_θ^*(r(G^'), X)_q_k≠ y_q_k), 
    s.t. θ^*=min_θL(θ;r(G),X), 
    
    |P^'|=|E^'_u|=|E^'_t|≤Δ ,

where f_θ is the targeted GNN-based fake new detector which has been trained on the clean data, 𝕀(·) is an indicator function, X is the feature matrix, z is the predicted label of news q_k, and Δ is the given budget. The goal is to maximize the likelihood of q_k being misclassified within the constraints.









§ METHOD


In this section, we describe our general attack framework which consists of two major modules, i.e., the fraudster selection module and the post injection module, as shown in Figure <ref>. Given the social context of news dissemination G as input, our framework adds a set of social interaction records and eventually fools the GNN-based detectors.




 §.§ Fraudster Selection Module

To select users to engage in the attack, following  <cit.>, we first utilize a pre-trained language model <cit.> to extract user representation from the users' historical posts. However, the GNN-based detector's attention on the user representation is often different from the local structure and global structure. To comprehensively consider the impact of user representation on different structures, we utilize the propagation tree to estimate the local influence of the user representation and construct the user-news bipartite graph to estimate the global influence. Accordingly, we propose a user selection module that can effectively optimize the set of potential fraudsters.



  
Local Influence Estimation.
To capture local influence, we first construct a propagation tree G^k_t=(𝒱^k_t,E^k_t) for target news q_k, which consists of:

    𝒱^k_t=   {v| ∀ v∈traversal (E_t, q_k)},
    
    E^k_t =   {(v_i, v_j)| ∀ (v_i, v_j)∈traversalpath (E_t, q_k)} ,

where traversal(E_t, q_k) indicates a function to traverse a tree with news q_k as the root according to E_t, and traversalpath(E_t, q_k) indicates a function to obtain the paths in above traverse process. Then, we let the representations of post nodes in G^k_t equal to the user representation of the post owner such that the GNN-based detector can learn user representation in a local view. Empirically, the gradient can characterize the model's attention on different inputs. Inspired by gradient-based attribution methods <cit.>, we leverage the model's attention on different feature elements to measure the local influence. Following the black-box manner, a GNN-based graph classifier f_θ_t is trained as a surrogate model to obtain attention information. Given the propagation tree G^k_t, the importance weight of the user representation is given by: 

    w_G^k_t = 1/N-1∑_v_i∈𝒱^k_t∖{q_k}∂ f_θ_t(A_G^k_t,X_G^k_t)_1-y_q_k/∂ x_v_i,

where A_G^k_t is the adjacency matrix of G^k_t, X_G^k_t is the user representation matrix of G^k_t, x_v_i is the user representation of the publisher of post v_i and N is the scale of 𝒱^k_t. The j-th entry in w_G^k_t indicates the relative importance for j-th feature element resulting from classifying q_k into the wrong class based on G^k_t. Intuitively, users with greater influence should have larger weights on the relatively important feature elements. According to the importance weight, the local influence of a fraudster u_i ∈ U_c is measured as:

    s_u_i = x_u_i· w_G^k_t,

where x_u_i is the user representation of the fraudster u_i. To improve efficiency, we utilize local influence for pruning. Obviously, nodes with lower local influence are not ideal choices. Hence, ceil(αΔ) fraudsters will be remained, where their local influence are ceil(αΔ)-largest.



  
Global Influence Estimation.
To estimate the global influence of the user representation, we construct a user-news bipartite graph G_b=(𝒱_b, E_b):

    𝒱_b=   U∪ Q, 
    
    E_b =   {(q_k,u_i)|∃ (u_i,p_j)∈ E_u  p_j∈𝒱^k_t}.

Due to the direct connections between users and news, we can utilize the gradient of the edge between them to estimate the global influence. Similarly, we train a GNN-based node classifier f_θ_b as the surrogate model based on G_b. Subsequently, the gradient of the potential edge between a fraudster u_i and the target news q_k is calculated as: 

    ∇_a_q_k,u_i = ∂ L(f_θ_b(A_G_b,X_G_b))_q_k/∂a_q_k,u_i,

where A_G_b is the adjacency matrix of G_b, X_G_b is the feature matrix of G_b and L is the cross-entropy loss function. In general, a larger gradient of the potential edge indicates that the corresponding user's participation in the attack will cause a greater impact on the target news. Hence, we select the fraudster u_i with the largest gradient in those remaining fraudsters and update the selected fraudster set U_a = U_a ∪{u_i}. The related edge is added to E_b and the selection process will be repeated until Δ fraudsters have been chosen. 





 §.§ Post Injection Module

Once a set of users U_a engaging in the attack is selected, we attempt to determine the targets of sharing behavior for these users such that the shared relations can be established. 


  
Post Initialization.
Since the budget for new interactions and the number of selected users are both Δ, each user u_i ∈ U_a can send a new post to maximize user participation within the attack budget. Hence, we can obtain a set of new post P^' and a set of user-post relation E^'_u. Note that the content of the post is still hard to generate and we temporarily set it to empty. Intuitively, directly sharing the target news q_k is not always the best choice. To measure the impact of selecting different shared targets, we employ the previous propagation tree G^k_t to model the existing propagation structure of the news q_k. Then, the sharing behaviors can be treated as injecting posts into G^k_t such that we obtain a new propagation tree G_o=(𝒱_o, E_o), where 𝒱_o=𝒱^k_t ∪ P^' and E_o = E^k_t. The new adjacency matrix of A_G_o can be formulated as:

    A_G_o= [ A_G^k_t       B;     B^T       O;         ],

where A_G^k_t is the original adjacency matrix of G^k_t, B is the potential edges between injected posts and the posts in the original tree and O is the potential edges between injected posts. At the beginning, B and O are both zero matrices.


  
Connection Optimization.
Subsequently, we leverage the gradient of the edges in B as the proxy of attention to find the optimal connection. Since the content of the post has not been optimized, it is infeasible to optimize the connection based on the text representation. Instead, we utilize the user representation to select the shared target. According to E_u and E^'_u, we let the representations of post nodes in G_o equal to the user representation of the post publisher. Then, a GNN-based graph classifier f_θ_t is utilized as a surrogate model to obtain gradient information. Different from the previous process, we only consider Δ injected posts. Hence, the simplified optimization process is described as:

    max_a_ij∇_B⊙ C = max_a_ij∂ L(f_θ_t(A_G_o,X_G_o))/∂ B⊙ C,

where ⊙ represents the element-wise product, A_G_o is the adjacency matrix of G_o, X_G_o is the user representation matrix of G_o, C is a mask matrix and a_ij is the edge with the largest gradient under constraints in B. At the beginning, C is a matrix of ones. We treat a_ij represents an optimal shared relation and expand E_o=E_o ∪{(v_i, v_j)}. Each post has a unique source in the tree. To ensure each new post can only be selected once, we let C_kj=0, ∀ k. Iteratively, we expand E_o until each injected post has one connection in E_o. Hence, we obtain the set of new shared relation E^'_t=E_o ∖ E^k_t.





  
Content Clone.
According to the new propagation tree G_o, we optimize the text representation for injected posts which has been set as empty before. Recent study <cit.> directly set the feature as zero, indicating an empty message, leading to little impact on detectors. To address this problem, we attempt to clone existing content into our new posts. Similarly, we leverage the model's attention on the text representations to estimate the influence of the existing content. Specifically, we extract text representations from the content of existing posts and retrain a GNN-based graph classifier f^'_θ_t according to the text representations. Then, for a new post p_i ∈ P^', we let the feature vector of it equal to the zero feature vector due to its empty content. Given the modified propagation tree G_o, the attention weight of the text representation for the new post p_i can be calculated as: 

    w_p_i = ∂ f^'_θ_t(A_G_o,X^'_G_o)_1-y_q_k/∂ x_p_i,

where X^'_G_o represents the text representation matrix of G_o, x_p_i is the feature vector for post p_i. Then, we randomly sample a set of potential post P_r ⊂ P. For each p_j ∈ P_r, we calculate the score as:

    s_p_i,j = x_p_j· w_p_i,

where x_p_j is the text representation of the post p_j. After computing the score for all posts in P_r, we select the potential post that has the largest score and clone the post content to the new post p_i. The content of all injected posts will be updated and then the posts can be injected into the social context. 

Based on the two modules, we mix the generated records of sharing behavior into the raw data and then fool the GNN-based fake news detectors.





§ EXPERIMENT





 §.§ Experimental Settings


















  
Datasets.
We adopt two real-world datasets <cit.>, i.e., Politifact and Gossipcop, from the PyTorch-Geometric library. 
To train detectors and our surrogate model, we split the data into 20% for the training, 10% for the validation, and 70% for the testing. The testing set is also treated as the set of the news to be attacked.










  
GNN-based Fake News Detectors.
We investigate the robustness of different GNN-based fake news detectors. For social-context-based detectors, following <cit.>, we construct a user-news bipartite graph. Leveraging Glove <cit.>, we extract the features of user nodes from their historical posts and the features of news nodes from the news contents. Subsequently, we attack three variants of GNN, i.e., GCN <cit.>, GraphSAGE <cit.>, and GAT <cit.>. Besides, following <cit.>, we construct a news engagement graph and attack the related proposed model. For propagation-based detectors, following <cit.>, we construct a tree-structured propagation graph. The features of post nodes are derived from the historical posts of their owner. Then, we investigate three variants of UPFD  <cit.>. We also investigate BiGCN <cit.> on a propagation and dispersion bi-directional tree. Different from the previous tree, the features of post nodes are derived from the post content. 

For clarity, we use G1, G2, G3, and G4 to represent a bipartite graph, a news engagement graph, a propagation tree, and a bi-directional tree mentioned above, respectively.


  
Baselines.
Since there is no attempt to conduct a general attack on detectors based on different graph structures, we need to make some necessary assumptions to extend the existing methods. The baseline method will conduct the attack on the user-news bipartite graph and connect users with the target news. To obtain a complete record of social interaction, we assume the users selected by the baselines randomly share the related post of target news and the new posts have empty content. The detailed baselines are described as follows:

Random, which randomly establishes a connection between a user and the target news.

DICE <cit.>, which randomly connects the target news to several users with a different label. The pseudo-labels of users are obtained from the surrogate model.

SGA <cit.>, one of the most effective targeted attacks on the node classification task. SGA constructs a subgraph for the target node and computes gradients of edges in the subgraph to generate edge perturbation.

MARL <cit.>, which is the first work to attack GNN-based fake news detectors utilizing a multiagent reinforcement learning framework. 











 §.§ Performance Analysis




  
Comparison with State-of-the-art Methods.

Our goal is to change the prediction of the target news. To this end, we evaluate the success rate of the attack which is defined as the number of misclassified news after the attack divided by the total number of target news. A larger success rate means better attack performance. Following the existing targeted attacks <cit.>, the budget of new records Δ equals to the degree of the target node in the user-news bipartite graph which represents the original number of people engaged in sharing the news. For each target news, we repeat the attack 10 times and report their average results. 

Table <ref> shows the attack performance when changing the prediction of fake news and real news respectively. Our method outperforms all baselines in most cases, particularly against propagation-based detectors on G3 and G4. Besides, GAFSI achieves a greater improved amount of success rate in the larger dataset, i.e., Gossipcop, demonstrating the ability to deal with large-scale graphs. MARL fails to reduce the search space, achieving poor attack performance. Compared to SGA, GAFSI has less influence on target news in three cases. This is because SGA solely focuses on modifying the user-news bipartite graph, while GAFSI makes a trade-off between different graph structures, improving the transferability with relatively minor costs. Furthermore, the attack performance between different variants also improves in some cases, especially against GraphSAGE.




  
Computational Efficiency.
We demonstrate the average running time for attacking single news in Table <ref>. Compared to SGA, we generate more complex and complete social interaction in a similar running time. MARL suffers from low time efficiency due to the vast search space and multiple samplings. In contrast to MARL, our approach shows a noticeable advantage in computational efficiency through utilizing a hierarchical strategy in the fraudster selection module.












 §.§ Ablation Studies and Other Analysis





  
Effects of Varying Hyper-parameters.
We examine the performance of GAFSI with different parameters α to make a trade-off between local influence and global influence in the fraudster selection module. The results against detectors on G1 and G3 are shown in Figure <ref>, GAFSI achieves a poor performance against detectors on G1 when only considering local influence, i.e., α=1. As α increases, we observe that enhancing the attack performance against detectors on G1 sacrifices the attack performance against detectors on G3. When α is smaller, this trade-off is worthwhile. Ultimately, the method's attack performance achieves a balance, indicating that subsequent nodes have a low impact on any models.











  
Effects of Different Post Sources.
To demonstrate the validity of the post injection module in GAFSI, we conduct ablation experiments on the connection strategy. A source of a post could be a news or a related post. To conduct the ablation study, we provide two strategies for comparison. Fraudsters can choose to directly share the target news, which is regarded as a Root strategy. Another choice for fraudsters is to randomly share a related post, which is regarded as a Random strategy. We conduct experiments against detectors on G3. As shown in Table <ref>, we compare these two strategies to ours, indicating that our approach can cause a greater impact on the propagation tree of the target news.





  
Effects of Different Post Content.
For the ablation study of post content generation, we directly set the new post as an empty text or randomly assign the existing content to it. In contrast to previous experiments, the detectors to be attacked classify news based on the content of posts. Therefore, we leverage text representation to train the detector on G3 and G4 before the attack. Table <ref> reports the results of different strategies against detectors that leverage text representation as post nodes' features. It is obvious that our strategy contributes to enhancing the attack performance.





  
Effects of Different Budgets.
To better evaluate the effectiveness of GAFSI with different budgets, as shown in Figure <ref>, we gradually reduce the budget to observe changes in attack performance on the detectors based on G1 and G3, respectively. As the budget increases, our method widens the gap in attack performance compared to other methods, especially for the fake news in Gossipcop. We also observe a slowing growth rate, which could be attributed to two factors. Firstly, later-selected users often have lower influences than earlier-selected ones, Secondly, the increase in the number of users might dilute the impact of single users.






  
Effects of Different News Degrees.
Intuitively, the degree of node has a large impact on attack performance. Since relatively low degrees constitute a significant portion of real-world datasets, nodes that have a degree less than 100 are selected for further investigation. We group the target news based on their node degrees on the bipartite graph. Then, we summarize the attack results for the grouped nodes. As shown in Figure <ref>, the success rate of our method decreases when the degree of target news increases. This implies that the detectors are more robust when predicting news with more participants involved. Besides, compared to detectors working on G1, those working on G3 seem less sensitive facing varying degrees, which may be attributed to their tree structures.






§ CONCLUSION



In this paper, we propose a general black-box adversarial attack framework against GNN-based fake news detectors with different graph structures. The key idea is to add fake social interaction to the social context via fraudster's sharing behaviors. Extensive experimental results demonstrate the effectiveness and superiority of our method in attacking different fake news detectors. In the future, we plan to investigate the engagement pattern and realize a more imperceptible attack.






§ ACKNOWLEDGEMENTS



This work was supported in part by the National Science Fund for Distinguished Young Scholarship of China (Grant no. 62025602), the National Natural Science Foundation of China (Grant nos. U22B2036, 62073263, 62203363, 62102105), the Fundamental Research Funds for the Central Universities (Grant no. D5000230112), the Tencent Foundation and XPLORER PRIZE, the Young Talent Fund of Association for Science and Technology in Shaanxi (Grant no. 20240105), and the Shaanxi Provincial Natural Science Foundation (Grant no. 2024JC-YBQN-0620).







named





