Graph data backdoor defense method and device based on spectral domain transformation and edge weight learning, equipment, medium and program product

Abstract

The application discloses a graph data backdoor defense method and device based on spectral domain transformation and edge weight learning, equipment, medium and program product, relates to the technical field of network security, and includes: obtaining and constructing a feature vector matrix and an eigenvalue matrix of an original graph data set; mapping each feature vector matrix from a spatial domain to a spectral space through spectral transformation to obtain a plurality of spectral domain node features, so as to construct a normal data distribution of the original graph data set, and determine whether each to-be-tested graph data is abnormal graph data; if it is determined that the graph data is abnormal, learning abnormal node features and abnormal adjacency relationships of the to-be-tested graph data through a multilayer perceptron to obtain abnormal edge weights; based on the abnormal edge weights, performing adaptive clipping on abnormal spectral components in the abnormal graph data through a Gaussian mixture model to obtain modified spectral domain node features; and performing inverse spectral transformation on each modified spectral domain node feature to reconstruct a target graph data set. The application can effectively resist multiple types of graph backdoor attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a graph data backdoor defense method and device based on spectral domain transformation and edge weight learning, equipment, medium and program product. BACKGROUND

[0002] In recent years, as a form of attack with strong concealment and high migration, graph backdoor attack poses a serious threat to the integrity and robustness of models. Attackers embed specific structural or feature patterns (i.e., backdoor triggers) in training data, which can induce false predictions through a small amount of perturbation during model inference, thereby undermining the credibility and security of the system.

[0003] However, traditional graph defense algorithms have the following shortcomings: they only analyze in the spatial domain, ignoring the energy distribution and structural pattern differences of graph signals in the spectral domain; they cannot effectively distinguish between in-distribution triggers (ID triggers) and out-of-distribution triggers (OOD triggers), resulting in a decrease in detection accuracy in complex attack scenarios; they lack an adaptive suppression mechanism for backdoor triggers, which can easily cause over-smoothing or loss of normal features; and existing methods are difficult to implement without labels or model parameters, and have poor robustness and generalization ability.

[0004] Therefore, there is an urgent need for a graph data backdoor defense method that can overcome these shortcomings to accurately identify and correct abnormal frequency bands, while maintaining unsupervised, explainable, and structural recoverability, and effectively resist multiple types of graph backdoor attacks. SUMMARY

[0005] The main purpose of the present application is to provide a graph data backdoor defense method and device based on spectral domain transformation and edge weight learning, equipment, medium and program product, which aims to effectively resist multiple types of graph backdoor attacks.

[0006] To achieve the above purpose, the present application provides a graph data backdoor defense method based on spectral domain transformation and edge weight learning, which comprises:

[0007] Obtain an original graph data set, and construct a feature vector matrix and an eigenvalue matrix corresponding to each to-be-tested graph data in the original graph data set;

[0008] Map each feature vector matrix from the spatial domain to the spectral space through spectral transformation to obtain a plurality of spectral domain node features;

[0009] Spectral clustering is performed on each spectral domain node feature to construct a normal data distribution corresponding to the original graph data set, and whether each to-be-tested graph data is abnormal graph data is determined according to the normal data distribution;

[0010] For any of the to-be-tested graph data, if it is determined that the to-be-tested graph data is abnormal graph data, an abnormal node feature and an abnormal adjacency relationship of the to-be-tested graph data are learned through a multi-layer perception to obtain an abnormal edge weight;

[0011] Based on each of the abnormal edge weights, adaptive clipping is performed on an abnormal spectral component in the abnormal graph data through a Gaussian mixture model to obtain a modified spectral domain node feature of the abnormal graph data;

[0012] Inverse spectral transformation is performed on each of the modified spectral domain node features to reconstruct a repaired target graph data set, and backdoor defense of graph data is completed.

[0013] In a possible implementation, the constructing of the feature vector matrix and the eigenvalue matrix corresponding to each to-be-tested graph data of the original graph data set comprises:

[0014] For any of the to-be-tested graph data, a node set and an edge set corresponding to the to-be-tested graph data are extracted, and an adjacency matrix is constructed based on the edge set, and a degree matrix in a diagonal form is constructed based on the sum of elements in each row of the adjacency matrix;

[0015] A Laplacian matrix is calculated according to the adjacency matrix and the degree matrix by using a normalization formula;

[0016] A feature decomposition operation is performed on the Laplacian matrix to obtain a feature vector matrix composed of feature vectors of the Laplacian matrix arranged in columns, and a diagonal form eigenvalue matrix composed of eigenvalues of the Laplacian matrix arranged in a diagonal line.

[0017] In a possible implementation, the mapping of each of the feature vector matrices from a spatial domain to a spectral space through spectral transformation to obtain a plurality of spectral domain node features comprises:

[0018] For any of the to-be-tested graph data, a node feature matrix of the to-be-tested graph data is obtained;

[0019] The to-be-tested graph data is mapped from a spatial domain to a spectral space based on the node feature matrix and the feature vector matrix through a spectral transformation formula to obtain a spectral domain node feature.

[0020] In a possible implementation, the spectral clustering of each of the spectral domain node features, the construction of a normal data distribution corresponding to the original graph data set, and the determination of whether each of the to-be-tested graph data is abnormal graph data according to the normal data distribution comprise:

[0021] According to the size of the eigenvalues in the eigenvalue matrix, each of the eigenvalues is divided into a plurality of frequency bands, and the frequency bands include a low frequency band, a medium frequency band, and a high frequency band.

[0022] The energy distribution of each of the spectral domain node features in each of the frequency bands is calculated through a frequency band energy distribution formula, and each of the energy distributions is normalized to calculate spectral energy entropy and a high frequency band energy proportion, thereby forming a multi-dimensional spectral feature corresponding to each of the spectral domain node features;

[0023] The multi-dimensional spectral features are analyzed by a spectral clustering method to filter out a normal data class, and the multi-dimensional spectral features of the normal data class are extracted to calculate a mean vector and a covariance matrix to construct a normal spectral domain distribution model;

[0024] The Mahalanobis distance between each of the to-be-tested graph data and the normal spectral domain distribution model is calculated.

[0025] For any of the to-be-tested graph data, if the Mahalanobis distance is greater than a preset distance threshold, the to-be-tested graph data is determined to be abnormal graph data containing a backdoor trigger.

[0026] In a possible implementation, if the to-be-tested graph data is determined to be abnormal graph data, the abnormal node features and abnormal adjacency relationships of the to-be-tested graph data are learned through a multi-layer perception machine to obtain abnormal edge weights, including:

[0027] Based on the abnormal node features and abnormal adjacency relationships of the to-be-tested graph data, the multi-layer perception machine outputs abnormal edge weights between any two abnormal node features;

[0028] All node pairs in the abnormal graph data are traversed to generate an abnormal edge weight matrix, and elements in the abnormal edge weight matrix are abnormal edge weights corresponding to edges.

[0029] In a possible implementation, based on the abnormal edge weights, adaptive clipping is performed on abnormal spectral components in the abnormal graph data through a Gaussian mixture model to obtain revised spectral domain node features of the abnormal graph data, including:

[0030] The abnormal edge weights are taken as a training sample set, the Gaussian mixture model is trained by using an expectation maximization algorithm, model parameters are iteratively solved until the model converges, and the model parameters include weights, means, and covariances of each mixed component;

[0031] According to the weights, means, and covariances of each mixed component, abnormal components of the abnormal edge weights are identified, and a clipping threshold is set according to a low probability density interval of the abnormal components;

[0032] A clipping operation is performed on a part of the spectral domain node features of the abnormal graph data whose amplitudes exceed the clipping threshold to obtain revised spectral domain node features.

[0033] In addition, to achieve the above object, the present application also proposes a graph data backdoor defense device based on spectral domain transformation and edge weight learning, comprising:

[0034] An acquisition module is configured to acquire an original graph data set and construct a feature vector matrix and an eigenvalue matrix corresponding to each to-be-tested graph data of the original graph data set;

[0035] A mapping module is configured to map each feature vector matrix from a spatial domain to a spectral space through spectral transformation to obtain a plurality of spectral domain node features;

[0036] A determination module is configured to perform spectral clustering on each spectral domain node feature, construct a normal data distribution corresponding to the original graph data set, and determine whether each to-be-tested graph data is abnormal graph data according to the normal data distribution;

[0037] A learning module is configured to, for any to-be-tested graph data, if the to-be-tested graph data is determined to be abnormal graph data, learn abnormal node features and abnormal adjacency relationships of the to-be-tested graph data through a multi-layer perception machine to obtain abnormal edge weights;

[0038] A correction module is configured to perform adaptive clipping on abnormal spectral components in the abnormal graph data through a Gaussian mixture model based on each abnormal edge weight to obtain corrected spectral domain node features of the abnormal graph data;

[0039] A reconstruction module is configured to perform inverse spectral transformation on each corrected spectral domain node feature to reconstruct a repaired target graph data set, thereby completing graph data backdoor defense.

[0040] In addition, to achieve the above object, the present application also proposes a graph data backdoor defense device based on spectral domain transformation and edge weight learning, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described above.

[0041] In addition, to achieve the above object, the present application also proposes a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described above.

[0042] In addition, to achieve the above object, the present application also provides a computer program product, which comprises a computer program, and the computer program, when executed by a processor, implements the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described above.

[0043] The present application provides a graph data backdoor defense method based on spectral domain transformation and edge weight learning, device, equipment, medium and program product, the graph data backdoor defense method based on spectral domain transformation and edge weight learning obtains the original graph data set, and constructs the feature vector matrix and the eigenvalue matrix corresponding to each to-be-tested graph data in the original graph data set, and then maps each feature vector matrix from the spatial domain to the spectral space through spectral transformation, obtains a plurality of spectral domain node features, and then performs spectral clustering on each spectral domain node feature, constructs the normal data distribution corresponding to the original graph data set, and determines whether each to-be-tested graph data is abnormal graph data according to the normal data distribution, and then for any to-be-tested graph data, if it is determined that the to-be-tested graph data is abnormal graph data, the abnormal node features and abnormal adjacency relations of the to-be-tested graph data are learned through a multilayer perceptron, and abnormal edge weights are obtained, and then based on each abnormal edge weight, the adaptive clipping of abnormal spectral components in the abnormal graph data is performed through a Gaussian mixture model, and the spectral domain node features of the abnormal graph data after correction are obtained, and then inverse spectral transformation is performed on each spectral domain node feature after correction, and the repaired target graph data set is reconstructed, the graph data backdoor defense is completed, the normal data distribution is automatically constructed through spectral clustering, manual annotation or model parameters are not required, the black box scene is adapted, the in-distribution (ID) and out-of-distribution (OOD) backdoor triggers can be detected and defended at the same time, the complex attack mode is adapted, the abnormal node features and adjacency relations are learned through an MLP (Multilayer Perceptron), the abnormal edges are accurately locked, and the normal feature misjudgment is reduced; the clipping threshold is adaptively set through a GMM (Gaussian Mixture Model), the abnormal spectral components are inhibited, the normal graph structure is prevented from being distorted, the defense is implemented based on the spectral energy distribution difference (i.e., abnormal spectral components), the abnormal root cause is clear, and the abnormal root cause is easy to trace, the present application does not depend on specific graph types or GNN (Graph Neural Network), can be embedded in multi-field data processing procedures such as social networks and molecular structures, has wide versatility, and the output can be directly used for clean data for training / inference, and the model robustness is improved. BRIEF DESCRIPTION OF DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application.

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, the other drawings can also be obtained based on these drawings without any creative effort.

[0046] Figure 1 A flowchart provided by the first embodiment of the method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning of the present application is shown in the figure.

[0047] Figure 2 One of the brief flowcharts provided by the method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning of the present application is shown in the figure.

[0048] Figure 3 The second brief flowchart provided by the method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning of the present application is shown in the figure.

[0049] Figure 4 The brief flowchart related to abnormal edge cutting provided by the method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning of the present application is shown in the figure.

[0050] Figure 5 The device structure of the hardware running environment related to the method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning of the embodiments of the present application is shown in the figure.

[0051] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0053] In order to better understand the technical solutions of the present application, the embodiments will be described in detail with reference to the accompanying drawings and specific embodiments.

[0054] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a big data service platform, a graph data backdoor defense system based on spectral domain transformation and edge weight learning, etc. The present embodiment and the following embodiments will be described below taking the graph data backdoor defense system based on spectral domain transformation and edge weight learning as an example.

[0055] Based on this, the present embodiment provides a method for defending against backdoors of graph data based on spectral domain transformation and edge weight learning, which is described in detail with reference to Figure 1 ,Figure 1 A flowchart is provided for the first embodiment of the spectrum domain transformation and edge weight learning based graph data backdoor defense method of the present application.

[0056] In this embodiment, the spectrum domain transformation and edge weight learning based graph data backdoor defense method comprises steps S11-S16:

[0057] Step S11, obtain the original graph data set, and construct the feature vector matrix and the eigenvalue matrix corresponding to each to-be-tested graph data in the original graph data set;

[0058] It should be noted that the original graph data set refers to a set containing a plurality of independent graph data, which can include normal graph data (graph data without backdoor triggers) and potential abnormal graph data (graph data containing in-distribution ID backdoor triggers or out-of-distribution OOD backdoor triggers), and is suitable for graph neural network task scenarios such as social network analysis, molecular structure prediction, and traffic network modeling. The to-be-tested graph data refers to a single independent graph data in the original graph data set that needs to be detected and processed for backdoor defense, each to-be-tested graph data has the basic structure of a node set, an edge set, and a node feature matrix, i.e., the to-be-tested graph data can be represented as where V is the node set, E is the edge set, and X is the node feature matrix. The feature vector matrix refers to a matrix composed of all the feature vectors of the constructed Laplacian matrix arranged by columns, which has the same dimension as the Laplacian matrix and is used to map the to-be-tested graph data from the spatial domain to the spectral space. The eigenvalue matrix refers to a diagonal matrix composed of all the eigenvalues of the constructed Laplacian matrix arranged by the diagonal line, the eigenvalues on the diagonal line correspond to the frequency properties of the graph signal, the smaller the eigenvalue, the more gentle the change of the graph signal (low-frequency signal), and the larger the eigenvalue, the more intense the change of the graph signal (high-frequency signal), and the abnormal energy of the backdoor trigger is usually concentrated in the eigenvalue interval corresponding to the high-frequency signal.

[0059] Specifically, the execution subject is a graph data backdoor defense system, which first acquires the original graph data set through a data interface, which can be derived from user interaction records of a social network platform, molecular structure data of a molecular database, or road network traffic data of a traffic department, etc.; then for each to-be-tested graph data in the original graph data set, the construction and eigenvalue decomposition of the adjacency matrix, the degree matrix, and the Laplacian matrix are completed in turn, and finally the feature vector matrix and the eigenvalue matrix exclusive to each to-be-tested graph data are obtained, ensuring that the subsequent spectral domain mapping step can be accurately processed based on the unique structural information of each to-be-tested graph data.

[0060] Step S12, map each feature vector matrix from the spatial domain to the spectral space through spectral transformation to obtain a plurality of spectral domain node features;

[0061] It should be noted that the spectrum transformation refers to a mathematical transformation operation of projecting the node features of the to-be-tested graph data from a spatial domain (a domain directly described by nodes and edges) to a spectral domain (a frequency domain described by frequency and energy) by using an eigenvector matrix, so as to realize conversion of a frequency domain representation of a graph signal. The spatial domain refers to a domain in which graph data is directly described by a node set, an edge set and a node attribute, and in the domain, the structure and features of the graph data exist in an intuitive "node-edge" association form. Traditional graph backdoor defense methods are mostly analyzed in the domain, but it is difficult to capture the frequency level difference of the graph signal. The spectral domain refers to a frequency domain space constructed based on a Laplacian matrix eigenvalue decomposition result. In the domain, the features of the graph data exist in a "frequency-energy" distribution form, and the energy distribution difference between normal graph data and abnormal graph data containing a backdoor trigger is significant in the domain (normal data is low in frequency energy, and abnormal data has a sudden increase in high frequency energy). The spectral domain node feature refers to a node feature representation formed in the spectral domain after the to-be-tested graph data is subjected to the spectrum transformation. The dimension is consistent with that of the node feature matrix in the spatial domain, and each element represents a frequency domain component of the original node feature on a corresponding eigenvector (frequency direction).

[0062] In the embodiment of the application, the core purpose of this step is to convert the normal and abnormal graph data features that are difficult to distinguish in the spatial domain into quantifiable "frequency-energy" features in the spectral domain, amplify the abnormal signal (high frequency energy aggregation) corresponding to the backdoor trigger, and provide a clear basis for distinguishing subsequent anomaly detection. This step does not need to rely on model parameters or supervised labels of the graph neural network, and can realize domain conversion only by mathematical transformation, which meets the design requirements of unsupervised defense, and can also retain the global structure information of the graph data, avoiding the problem of local structure misjudgment in the spatial domain analysis.

[0063] Specifically, reference can be made to steps S31-S32, which will not be repeated here.

[0064] In step S13, the spectral clustering is performed on the spectral domain node features, the normal data distribution corresponding to the original graph data set is constructed, and whether each to-be-tested graph data is abnormal graph data is determined according to the normal data distribution.

[0065] It should be noted that spectral clustering refers to a graph theory-based unsupervised clustering algorithm, which maps data to a low-dimensional space and clusters based on the similarity of data in the low-dimensional space. It is suitable for processing high-dimensional, unstructured spectral domain node feature data, and can automatically cluster spectral feature similar test graph data into a class without manually setting the number of clustering categories or structure templates. Normal data distribution refers to the distribution of spectral features of all normal graph data in the original graph data set in the spectral space. The distribution is presented in the form of a mathematical model (such as a Mahalanobis distance distribution model), and includes the average level (mean vector) of normal spectral features and the correlation between features (covariance matrix). It is the "baseline standard" for determining whether the test graph data is abnormal. Abnormal graph data refers to test graph data with a backdoor trigger (ID or OOD type) whose spectral features deviate significantly from the normal data distribution. Such graph data exhibits characteristics such as a sudden increase in high-frequency energy and an increase in spectral energy entropy in the spectral space, and its Mahalanobis distance exceeds the preset threshold.

[0066] In the embodiments of the present application, the core purpose of this step is to purify normal graph data from the original graph data set (containing normal and potential abnormal data) through spectral clustering, construct a reliable normal data distribution model, and then realize abnormality determination of all test graph data based on the model, solving the problem of relying on manual annotation or model parameters in traditional defense methods, and effectively distinguishing between in-distribution and out-of-distribution backdoor triggers.

[0067] Specifically, the implementation idea of this step is divided into two parts: "clustering and purifying normal data" and "distance determination of abnormal data". First, the spectral clustering is used to group test graph data with similar spectral domain node features, and the "normal cluster" (corresponding to normal graph data) with the largest sample size and the smallest cluster feature fluctuation is selected. Then, a distribution model is constructed based on the spectral features of the normal cluster, and the Mahalanobis distance between the test graph data and the model is calculated to quantify the deviation and determine the abnormality. Steps S41-S45 can be referred to, and will not be repeated here.

[0068] Step S14, for any test graph data, if the test graph data is determined to be abnormal graph data, the abnormal node features and abnormal adjacency relationships of the test graph data are learned through a multi-layer perception machine to obtain abnormal edge weights.

[0069] It should be noted that the multi-layer perception (MLP) refers to a fully connected neural network composed of an input layer, multiple hidden layers and an output layer, which can learn the complex mapping relationship between input features and output targets through a nonlinear activation function (such as ReLU, Sigmoid), and is used in this step to learn the abnormal node features and abnormal adjacency relationship, and output the abnormal weight of the edge. The abnormal node feature refers to the feature of the node itself in the abnormal graph data, which deviates from the normal range (such as the charge value of the abnormal atom in the molecular structure, the interest label of the false user in the social network), which is usually directly associated with the backdoor trigger, and is an important basis for determining the abnormal edge. The abnormal adjacency relationship refers to the connection relationship between nodes in the abnormal graph data, which does not conform to the normal structure rule (such as the chemical bond that should not exist in the molecule, the friend connection that is conspicuous in the social network), which is the core component of the backdoor trigger. The abnormal edge weight refers to the probability value of quantifying each edge in the abnormal graph data as a "backdoor trigger key edge", the greater the weight value, the higher the possibility that the corresponding edge is an abnormal edge (a component of the backdoor trigger), which is usually stored in the form of a matrix (abnormal edge weight matrix), and the dimension is consistent with the adjacency matrix of the abnormal graph data.

[0070] In the embodiment of the application, the core purpose of this step is to accurately locate the abnormal edge in the abnormal graph data, to provide a targeted basis for subsequent spectral domain adaptive clipping, and to avoid the problem of normal edge misdeletion caused by traditional defense "one-size-fits-all" processing.

[0071] Specifically, the implementation idea of this step is "joint learning of node features and adjacency relationship": the abnormal node features and the abnormal adjacency relationship are converted into the input features of the multi-layer perception, the mapping rule between the two and the abnormal edge weight is learned through model training, and finally the quantifiable edge weight is output, realizing the accurate identification of the abnormal edge. Please refer to steps S51-S52, which will not be repeated here.

[0072] Step S15, based on each abnormal edge weight, performing adaptive clipping on the abnormal spectral component in the abnormal graph data through a Gaussian mixture model, to obtain the modified spectral domain node features of the abnormal graph data;

[0073] It should be noted that the Gaussian mixture model (GMM) refers to a probability model composed of a plurality of Gaussian distributions (mixed components) weighted combination, which can fit the complex data distribution of non-single normal distribution, and is used to model the distribution of abnormal edge weight in this step, realizing the separation of abnormal edge weight and normal edge weight. Abnormal spectral components refer to spectral domain node features of abnormal graph data corresponding to abnormal edge weights, which have energy significantly higher than the normal range. These components are usually concentrated in the high frequency band of the eigenvalue matrix (corresponding to large eigenvalues), which is a direct manifestation of the backdoor trigger in the spectral space. Adaptive clipping refers to automatically determining the clipping threshold based on the abnormal edge weight distribution learned by the Gaussian mixture model, and only performing the reduction operation on the part of the abnormal spectral components that exceeds the threshold, avoiding the misprocessing of normal spectral components, and achieving the effect of "precise clipping of abnormal and preserving normal features". The corrected spectral domain node feature refers to the spectral domain node feature of the abnormal graph data after adaptive clipping, in which the abnormal spectral components are suppressed and the normal spectral components are preserved. The feature has eliminated the abnormal signal of the backdoor trigger.

[0074] In the embodiments of the application, the core purpose of this step is to eliminate the abnormal spectral signal corresponding to the backdoor trigger in the abnormal graph data, while maximizing the preservation of the normal structure and feature information of the graph data, solving the problem of excessive smoothing or loss of normal features of traditional defense methods.

[0075] Specifically, the implementation idea of this step is divided into two parts: "GMM modeling of abnormal edge weight" and "targeted clipping of abnormal spectral components". First, the Gaussian mixture model is used to model the abnormal edge weight, separate the distribution of normal edge weight and abnormal edge weight, and determine the clipping threshold. Then, based on the threshold, the abnormal spectral components are located, and the spectral amplitude exceeding the threshold is reduced to achieve precise suppression of abnormal signals. Please refer to steps S61-S63, which will not be repeated here.

[0076] Step S16: performing inverse spectral transformation on each of the corrected spectral domain node features to reconstruct a repaired target graph data set, completing the graph data backdoor defense.

[0077] It should be noted that the inverse spectral transformation refers to a mathematical transformation operation of mapping the corrected spectral domain node features from the spectral space back to the spatial domain, which is the inverse process of the spectral transformation in step S12. The core is to realize the conversion of the spectral domain frequency domain signal to the spatial domain node feature and structure through matrix multiplication of the feature vector matrix and the corrected spectral domain node feature matrix. The repaired target graph data set refers to a graph data set without backdoor pollution composed of all to-be-tested graph data (normal graph data is directly retained, and abnormal graph data is reconstructed through inverse spectral transformation). The repaired target graph data set can be directly used for training or reasoning of the graph neural network, and can effectively avoid the model error prediction caused by the backdoor trigger. The graph data backdoor defense refers to the technical process of realizing detection, positioning and removal of the backdoor trigger in the original graph data set through steps S11-S16, ensuring that the output target graph data set is free of backdoor pollution, thereby improving the robustness and security of the graph neural network.

[0078] In the embodiment of the application, the core purpose of this step is to restore the abnormality-suppressed spectral domain features to the graph data structure and features in the spatial domain, form clean data that can be directly applied, and complete the backdoor defense closed loop of "detection-treatment-repair".

[0079] Specifically, the implementation idea of this step is "inverse transformation and reconstruction of features + adjustment of adjacency matrix": first, the repaired spatial domain node feature matrix is obtained through inverse spectral transformation; then, combined with the abnormal edge weight matrix of step S14, the edges corresponding to the abnormal weights are deleted to obtain the repaired adjacency matrix; finally, the repaired graph data is composed of the repaired node set, the edge set and the node feature matrix, and all the repaired graph data constitute the target graph data set. In an embodiment, when this step is executed, the feature vector matrix U obtained in step S11 is first called, matrix multiplication is performed using the inverse spectral transformation formula to obtain the repaired node feature matrix X; then the repaired node set V, the edge set E corresponding to the adjacency matrix A, and the repaired node feature matrix X are combined to form a single repaired graph data; finally, all the repaired graph data corresponding to the to-be-tested graph data are summarized to obtain the repaired target graph data set, which can be referred to as Figure 2 and Figure 3 .

[0080] Further, the application scenarios of the repaired target graph data set are:

[0081] 1. In the field of drug research and development, the training data of molecular structure prediction models (such as GNN-based molecular activity prediction models) often face the risk of being embedded with backdoor triggers - attackers may tamper with chemical bonds (such as adding abnormal functional groups as OOD backdoor triggers) in some molecular graphs, causing the model to misjudge molecules containing specific abnormal structures as "highly active", affecting drug screening efficiency. Use the repaired target graph data set (molecular structure data without backdoor triggers) for model training:

[0082] The repaired target graph dataset contains 10,000 clean molecular structures, each molecule has no abnormal nodes (atoms), edges (chemical bonds), and node features (atomic types, charge values). For example, the abnormal chemical bonds in the original data are deleted, and the abnormal atomic properties are corrected.

[0083] The trained model can accurately predict the biological activity of molecules (such as whether they can inhibit specific target proteins), and will not trigger false predictions due to the attacker's pre-set abnormal structures (such as specific functional groups). This effectively ensures the correct identification of "effective molecules" during drug screening and reduces the risk of research and development.

[0084] 2. The user interaction graph data of social network platforms (nodes are users, edges are attention / comment interactions) is easy to be injected with ID backdoor triggers (such as "fake user-real user" interaction chains constructed by attackers), which can cause traditional anomaly detection models to mistakenly identify fake users as "normal active users", leading to problems such as spam propagation and account theft. Use the repaired target graph dataset (user interaction graph without backdoor triggers) for anomaly user detection model training:

[0085] The target graph dataset contains 50,000 user interaction records, with abnormal interaction edges of "fake user clusters" in the original data deleted and abnormal features of fake users (such as abnormally high interaction frequency and no real interest tags) corrected. Then input the target graph dataset into the GNN-based anomaly user detection model, which learns the interaction patterns of normal users (such as interaction frequency and interest correlation between real users) to build a normal user interaction distribution, so that the model can accurately identify fake users in new input interaction graphs, effectively block spam information posted by fake users, reduce harassment of real users, and ensure the safe operation and user experience of social platforms.

[0086] 3. The intersection traffic graph data of traffic management departments (nodes are intersections, edges are road segments, and node features are real-time traffic) may be embedded with OOD backdoor triggers (such as fake traffic peaks at specific times) due to data collection device failures or human tampering, causing the traffic prediction model to output incorrect results and affecting road network scheduling (such as misjudging congested road segments and unreasonable allocation of police forces). Use the repaired target graph dataset (traffic graph without backdoor triggers) for traffic prediction model inference:

[0087] The target graph data set contains traffic data of 100 intersections in a city for 30 consecutive days. The false traffic peaks in the original data have been corrected (e.g., high-frequency abnormal spectral components are eliminated by GMM cutting, and the true traffic fluctuations are restored), ensuring that the traffic characteristics (e.g., the average traffic during the morning rush hour from 7:00 to 9:00) of each intersection conform to historical normal patterns. Then, the target graph data set is input into a GNN-based traffic flow prediction model (e.g., T-GCN) to predict the traffic flow of each intersection in the next 24 hours, so that the traffic management department can accurately dispatch based on the prediction results: increase the number of police officers to guide traffic in advance at congested intersections, and optimize the signal light duration during the traffic low period to reduce the commuting time of citizens and improve the efficiency of the road network.

[0088] The present embodiment automatically constructs normal data distribution through spectral clustering, without manual annotation or model parameters, adapts to black box scenarios, can detect and defend both in-distribution (ID) and out-of-distribution (OOD) backdoor triggers, adapts to complex attack patterns, and learns abnormal node features and adjacency relationships through MLP to accurately lock abnormal edges and reduce false positives of normal features. By adaptively setting the cutting threshold through GMM, the abnormal spectral components are suppressed while avoiding distortion of the normal graph structure. The defense is based on the difference in spectral energy distribution (i.e., abnormal spectral components), which clearly identifies the root cause of the anomaly and facilitates tracing. It does not depend on specific graph types or GNNs, can be embedded into data processing procedures in multiple fields such as social networks and molecular structures, has wide applicability, and outputs clean data that can be directly used for training / inference, improving model robustness.

[0089] In a possible implementation, the constructing of the feature vector matrix and the eigenvalue matrix corresponding to each to-be-tested graph data of the original graph data set comprises:

[0090] In step S21, for any to-be-tested graph data, the node set and edge set corresponding to the to-be-tested graph data are extracted, and an adjacency matrix is constructed based on the edge set, and a degree matrix in diagonal form is constructed based on the sum of elements in each row of the adjacency matrix.

[0091] It should be noted that the to-be-tested graph data refers to a single independent graph data to be subjected to backdoor defense processing, which can be represented as The node set V refers to a set of all entities in the to-be-tested graph data, such as a set of atoms in a molecular structure, a set of users in a social network, and each element in the set corresponds to a node of the graph, which is usually distinguished by a unique identifier (such as an atom number, a user ID). The edge set E refers to a set of association relationships between nodes in the to-be-tested graph data, such as chemical bonds between atoms in a molecule, interaction relationships between users in a social network, and the existence of an edge directly reflects the connection state between nodes. The adjacency matrix A refers to a square matrix used to quantitatively describe the edge set. If the to-be-tested graph data contains N nodes, the adjacency matrix has a dimension of N x N. The degree matrix D refers to a diagonal matrix used to describe the connection degree of the node, which has the same dimension as the adjacency matrix, and only the diagonal elements have values.

[0092] In the embodiments of the present application, the core purpose of this step is to convert the unstructured topological relationship (text / graph description of nodes and edges) of the to-be-tested graph data into a structured numerical matrix (adjacency matrix, degree matrix). Through the logic of "extracting structure-constructing matrix", the topological information of the to-be-tested graph data is completely retained, and the loss of structure caused by manual processing is avoided. At the same time, the matrix form is convenient for computer to perform efficient operation.

[0093] In one possible implementation, when extracting the node set and the edge set, the standard format file (such as GraphML, CSV) of the to-be-tested graph data can be read through a graph data parsing tool (such as NetworkX, PyTorch Geometric) to automatically identify the node ID and the connection relationship of the edge; when constructing the adjacency matrix, according to the node pair in the edge set, 1 or 0 is filled in the corresponding matrix position, and if it is a weighted graph, the corresponding weight value is filled; when constructing the degree matrix, the sum of each row elements of the adjacency matrix is calculated through a matrix row sum function, and the result is taken as the diagonal element of the degree matrix, and the non-diagonal elements are set to 0.

[0094] Specifically, first, a graph data parsing interface is called to extract the node set (such as a list of 10 atom IDs) and the edge set (such as a list of 12 node pairs of chemical bonds) of the to-be-tested graph data; second, a zero matrix of N x N is initialized as the adjacency matrix A based on the number of nodes, and the matrix elements are set to 1 at the corresponding node pair positions by traversing the edge set; then the sum of each row elements of the adjacency matrix A is calculated to construct the diagonal degree matrix D; finally, the symmetry of the adjacency matrix A (in the case of an undirected graph) and the diagonal of the degree matrix D are verified to ensure that the matrix construction is correct, and the adjacency matrix and the degree matrix are output to the next module.

[0095] For example, the to-be-tested graph data is a certain molecular structure data (undirected graph), which contains:

[0096] 10 atoms - node set V = {C1, C2, C3, H1, H2, H3, H4, H5, H6, H7};

[0097] 12 chemical bonds - edge set E = {(C1, C2), (C1, C3), (C1, H1),..., (C3, H7)}.

[0098] The matrix construction module reads the GraphML file of the molecule through PyTorch Geometric, extracts the node ID and edge connection relationship, initializes a 10x10 zero matrix as the adjacency matrix, sets A[0, 1] and A[1, 0] to 1 for each node pair in the edge set, such as the (C1, C2) pair corresponding to node indexes 0 and 1, calculates the sum of each row element of the adjacency matrix A (for example, the sum of the row corresponding to node C1 is 4, representing 4 chemical bonds), and constructs a 10x10 degree matrix D (the diagonal elements are 4, 2, 3, 1, 1, 1, 1, 1, 1, 1, and the non-diagonal elements are 0).

[0099] In step S22, a normalization formula is used to calculate the Laplacian matrix based on the adjacency matrix and the degree matrix.

[0100] It should be noted that the normalization formula refers to a mathematical formula used to eliminate the influence of node degree difference on graph structure analysis. The Laplacian matrix refers to a comprehensive matrix that combines the adjacency matrix and the degree matrix, and its core role is to depict the global structure characteristics and signal propagation law of the graph. In spectral domain analysis, it can be regarded as the "second-order differential operator" of the graph, and can reflect the smoothness of the graph signal.

[0101] The core purpose of this step is to construct a Laplacian matrix with "structural balance" through normalization operation - to avoid the dominance of some nodes with high degree (such as popular users in social networks) in subsequent spectral domain analysis, which can mask the abnormal structure corresponding to the backdoor trigger.

[0102] Specifically, first check whether the degree matrix D has zero diagonal elements (isolated nodes), and mark the zero elements to avoid calculation errors, and then use the normalization formula to calculate the Laplacian matrix based on the adjacency matrix and the degree matrix, where the normalization formula is:

[0103]

[0104] where L is the Laplacian matrix, the identity matrix I is a square matrix with diagonal elements equal to 1 and non-diagonal elements equal to 0, with the same dimension as the adjacency matrix, used to maintain the numerical stability of the matrix during normalization, D: degree matrix, A: adjacency matrix.

[0105] In step S23, the eigenvalue decomposition operation is performed on the Laplacian matrix to obtain the eigenvector matrix composed of the eigenvectors of the Laplacian matrix arranged by columns, and the diagonal form of the eigenvalue matrix composed of the eigenvalues of the Laplacian matrix arranged by diagonal lines.

[0106] It should be noted that eigenvalue decomposition refers to the mathematical operation of decomposing a square matrix into an eigenvector matrix U and an eigenvalue matrix Λ. This operation is only applicable to square matrices, and its core is to extract the matrix's "intrinsic features" (eigenvalues ​​and eigenvectors). This step extracts the frequency domain features of the graph through mathematical operations, making backdoor triggers (such as subtle anomalous edges) that are difficult to detect in the spatial domain appear as energy anomalies corresponding to high-frequency eigenvalues ​​in the spectral domain, facilitating subsequent detection. In one embodiment, eigenvalue decomposition can be performed using a high-performance linear algebra library. This library optimizes computational efficiency for symmetric matrices (normalized Laplacian matrices are symmetric matrices) and can directly output the sorted eigenvalues ​​and eigenvectors.

[0107] Specifically, first, the symmetry of L is verified (symmetric matrices simplify eigenvalue decomposition calculations, and eigenvectors are orthogonal). If a slight asymmetry (numerical error) exists, L is first symmetricized. Next, the linear algebra library is called to perform eigenvalue decomposition, setting parameters to sort the output eigenvalues ​​in ascending order. Then, the eigenvectors are arranged column-wise to form the eigenvector matrix U = [u1, u2, ..., u...]. n Arrange the eigenvalues ​​diagonally to form an eigenvalue matrix. Finally, check the range of eigenvalues ​​to ensure the decomposition results are correct, and output U and Λ to the spectral domain mapping module.

[0108] This embodiment constructs an adjacency matrix and a degree matrix using node and edge sets, fully preserving the topological relationships of the graph data under test (such as whether nodes are connected and the number of connections). Simultaneously, by using a normalized formula to calculate the Laplacian matrix, it weakens the excessive influence of nodes with high degrees on graph structure analysis, making the structural contributions of nodes with different degrees more balanced and avoiding analytical biases caused by differences in node degrees. Furthermore, this process does not depend on specific graph types (molecular graphs, social graphs, etc.), but only constructs the matrix based on the general structure of graph data (nodes, edges). It is suitable for backdoor defense of graph data in multiple domains covered by the solution. The entire process requires no manual annotation or model parameters, and is calculated solely through the graph data's own structure, meeting the solution's design goal of "label-free, unsupervised defense" and lowering the application threshold.

[0109] In one feasible implementation, the step of mapping each of the feature vector matrices from the spatial domain to the spectral space through spectral transformation to obtain several spectral domain node features includes:

[0110] Step S31: For any of the graph data to be tested, obtain the node feature matrix of the graph data to be tested;

[0111] It should be noted that the node feature matrix ( ) refers to a numerical matrix used to describe the properties of each node in the to-be-tested graph data, that is, the to-be-tested graph data contains N nodes, each node has F attribute characteristics, and R is a real number field.

[0112] In one possible implementation, when obtaining the node feature matrix, a corresponding data reading method can be selected according to the type of the to-be-tested graph data: for molecular structure data, the types, charge values, electronegativity, and other attributes of atoms are read from a molecular database (such as PubChem) to construct a matrix; for social network data, the attributes such as the age, interest labels (quantified as numerical values), and interaction frequency of users are extracted from a platform database to construct a matrix; and the obtained matrix is preprocessed (such as missing value filling and standardization) to ensure that there is no invalid data to interfere with subsequent operations.

[0113] Specifically, first, the corresponding feature data source (database interface, local file) is located according to the application scenario (such as molecule, social network) of the to-be-tested graph data; second, the preset attributes of each node (such as 5 core attributes of a molecular node and 4 core attributes of a social network node) are extracted; then, the attribute quantitative values are filled into the matrix according to the rule of “node row, attribute column” to form an initial node feature matrix; and finally, the initial matrix is preprocessed, such as filling missing values with the mean value and mapping the numerical values to the interval [0, 1] by Min-Max normalization, to output a clean node feature matrix.

[0114] In step S32, the to-be-tested graph data is mapped from the spatial domain to the spectral space based on the node feature matrix and the eigenvector matrix by using a spectral transformation formula, to obtain spectral domain node features.

[0115] It should be noted that the spectral transformation formula refers to a mathematical formula used to convert the node features of the to-be-tested graph data from the spatial domain to the spectral space. The spectral domain node features refer to the node feature representation formed in the spectral space after the spectral transformation of the to-be-tested graph data, and the dimensionality is consistent with that of the node feature matrix, and each element represents the frequency domain component of the original node feature in the corresponding eigenvector (frequency direction).

[0116] Specifically, when performing spectral transformation, first, the dimensionality compatibility of the node feature matrix X and the eigenvector matrix U is verified (the number of rows of U needs to be consistent with the number of rows of X, both of which are the number of nodes N), and if the dimensionality is not matched, the previous step is modified; second, the spectral transformation formula is executed through a matrix operation library, specifically:

[0117]

[0118] wherein, represents the node features in the spectral space, U is the eigenvector matrix, X is the node feature matrix; and finally, Standardization (such as Z-Score standardization, making the mean of each feature dimension 0 and the standard deviation 1) is performed to eliminate the influence of the difference in the numerical range of different feature dimensions on the subsequent energy calculation and to ensure the comparability of the spectral domain features.

[0119] In this embodiment, by mapping the graph data from the spatial domain (node-edge structure) to the spectral space, the energy of normal data is concentrated in the low frequency band, and the abnormal energy of the backdoor trigger (ID / OOD type) is significantly aggregated in the high frequency band, greatly amplifying the feature difference between normal and abnormal data. The problem of abnormality being difficult to detect in the spatial domain is solved. Whether it is an in-distribution (ID) or out-of-distribution (OOD) backdoor trigger, it will show abnormal high-frequency energy in the spectral space. The spectral domain node features can uniformly depict such abnormalities, realize compatible detection of multiple types of triggers, and do not need to adjust the method for different triggers.

[0120] In a feasible implementation, the spectral clustering of each spectral domain node feature is performed to construct a normal data distribution corresponding to the original graph data set, and whether each to-be-tested graph data is abnormal graph data is determined according to the normal data distribution, including:

[0121] In step S41, according to the size of the eigenvalue in the eigenvalue matrix, each eigenvalue is divided into several frequency bands, and the frequency bands include a low frequency band, a medium frequency band, and a high frequency band.

[0122] It should be noted that the eigenvalue matrix refers to a diagonal matrix obtained by performing eigenvalue decomposition on the normalized Laplacian matrix, and the elements on the diagonal line are the eigenvalues of the Laplacian matrix, and the non-diagonal line elements are 0. The size of the eigenvalue directly corresponds to the frequency attribute of the graph signal. The eigenvalue refers to a single numerical value on the diagonal line of the eigenvalue matrix, and each eigenvalue corresponds to a feature vector. The smaller the eigenvalue, the more gentle the change of the graph signal in the direction of the corresponding feature vector (corresponding to a low-frequency signal, reflecting the global stable structure of the graph); the larger the eigenvalue, the more intense the change of the graph signal (corresponding to a high-frequency signal, and the abnormal energy of the backdoor trigger is usually concentrated in this frequency band). The frequency band refers to an interval divided according to the size of the eigenvalue, which is used to classify graph signals of different frequency ranges. In this step, the low frequency band, the medium frequency band, and the high frequency band are explicitly divided, and each frequency band corresponds to a group of continuous eigenvalues and associated feature vectors.

[0123] The global frequency characteristics of the graph signal can be decomposed into local frequency band analysis by band division, avoiding the "frequency information confusion" caused by directly analyzing all eigenvalues, while accurately locking the high frequency region where the backdoor trigger may exist. In an embodiment, the band division can use "equal quantity division" or "eigenvalue interval division": equal quantity division refers to dividing all eigenvalues in the eigenvalue matrix into 3 groups by sorting them from small to large, and each group of eigenvalues constitutes a frequency band (for example, 100 eigenvalues, the first 34 are low frequency band, the middle 33 are medium frequency band, and the last 33 are high frequency band); eigenvalue interval division refers to determining the division threshold according to the statistical distribution of the eigenvalues (for example, eigenvalues ≤0.3 are classified as low frequency band, 0.3< eigenvalues ≤1.0 are classified as medium frequency band, and eigenvalues >1.0 are classified as high frequency band). This method is more consistent with the actual frequency distribution of the graph signal, and is especially suitable for scenarios where the eigenvalues are unevenly distributed.

[0124] Specifically, first, all eigenvalues on the diagonal are extracted from the eigenvalue matrix to form an eigenvalue list; second, the eigenvalue list is sorted in ascending order to ensure that the subsequent frequency bands correspond to the order of low to high frequencies; then, according to the preset division rule (equal quantity or interval division), the sorted eigenvalues are divided into low, medium and high frequency bands, and the eigenvalue index and corresponding eigenvector of each frequency band are recorded; finally, it is verified whether the eigenvalues of each frequency band are continuous and non-overlapping to ensure the accuracy of the division result.

[0125] Step S42, calculate the energy distribution of each said spectral domain node feature in each said frequency band by the frequency band energy distribution formula, and normalize each said energy distribution to calculate the spectral energy entropy and the high frequency band energy proportion, forming the multi-dimensional spectral feature corresponding to each said spectral domain node feature;

[0126] It should be noted that the frequency band energy distribution formula refers to a mathematical formula used to calculate the total energy of the spectral domain node feature in a certain frequency band. The energy distribution refers to a vector composed of energy values of each frequency band, which is used to describe the energy distribution of the spectral domain node feature in different frequency intervals. Normalization refers to the operation of converting each frequency band energy value to the proportion of total energy, eliminating the interference of different graph data scale differences on energy analysis, and making the energy distribution have cross-graph comparability.

[0127] Further, the spectral energy entropy H refers to a statistical index for quantifying the uniformity of energy distribution in each frequency band (the degree of disorder), and the smaller the entropy value, the more concentrated the energy (normal data, energy concentrated in low frequency band), and the larger the entropy value, the more disordered the energy distribution (abnormal data, sudden increase of high frequency band energy). The high frequency band energy ratio R refers to the proportion of high frequency band energy value to total energy, which is a direct indicator for positioning backdoor trigger (normal data ratio is low, and abnormal data ratio is significantly increased). The multi-dimensional spectral feature refers to a feature vector composed of the normalized frequency band energy vector, spectral energy entropy, and high frequency band energy ratio, such as x=[E norm,低频 , E norm,中频 , E norm,高频 , H, R], which is usually 5-dimensional, and can comprehensively characterize the frequency characteristics of the spectral domain node feature.

[0128] Specifically, first, the energy distribution of each spectral domain node feature in each frequency band is calculated by the frequency band energy distribution formula, and the frequency band energy distribution formula is:

[0129]

[0130] wherein, , represents the node feature in the spectral space; second, the total energy is calculated and the normalization processing is performed on each frequency band energy to obtain a normalized energy vector; then, the spectral energy entropy and the high frequency band energy ratio are calculated based on the normalized energy ratio; finally, the normalized energy vector, the spectral energy entropy, and the high frequency band energy ratio are combined in order to form the multi-dimensional spectral feature corresponding to the spectral domain node feature, and output to the spectral clustering module.

[0131] In step S43, the multi-dimensional spectral features are analyzed by a spectral clustering method, normal data classes are screened out, and the multi-dimensional spectral features of the normal data classes are extracted to calculate the mean vector and the covariance matrix to construct a normal spectral domain distribution model.

[0132] It should be noted that the normal data class refers to the clustering cluster with the largest sample size and the smallest cluster feature fluctuation after clustering, and the multi-dimensional spectral features in the cluster meet the rules of normal graph data (such as high low frequency energy ratio, small spectral energy entropy, and low high frequency ratio), representing a normal graph data set without backdoor trigger. The mean vector u refers to a vector composed of the average values of all multi-dimensional spectral features in the normal data class in each feature dimension, which is consistent with the multi-dimensional spectral feature (such as 5-dimensional), and reflects the average level of the normal data spectral feature. The covariance matrix It refers to a square matrix describing the correlation degree between each dimension of the multi-dimensional spectral feature in the normal data class, with the dimension being "multi-dimensional spectral feature dimension x multi-dimensional spectral feature dimension" (such as 5 x 5). For example, "low frequency normalized energy" is negatively correlated with "high frequency proportion", and the value at the corresponding position in the covariance matrix will reflect this negative correlation. Its role is to eliminate the interference of the correlation between features on subsequent distance calculation.

[0133] Specifically, the multi-dimensional spectral feature set is standardized (to ensure that the numerical ranges of each dimension are consistent), and a feature similarity matrix is constructed (such as using a Gaussian kernel function to calculate similarity); secondly, a spectral clustering algorithm (such as a K-means clustering algorithm) is called, and the clustering effect is verified by the silhouette coefficient (the clustering result with the largest silhouette coefficient is selected to ensure the clustering quality); then the sample quantity and feature variance within each cluster are counted, and the cluster with the largest sample quantity and the smallest variance is selected as the normal data class; finally, all multi-dimensional spectral features of the normal data class are extracted, the mean value of each feature dimension is calculated to obtain the mean vector, and the covariance of any two dimensions is calculated to obtain the covariance matrix, and the two are combined to form the normal spectral domain distribution model.

[0134] Step S44, calculating the Mahalanobis distance between each of the to-be-tested graph data and the normal spectral domain distribution model;

[0135] It should be noted that the Mahalanobis distance refers to a statistical distance used to quantify the degree of deviation between multi-dimensional spectral features and the normal spectral domain distribution model. Compared with the Euclidean distance, the core advantage of the Mahalanobis distance is that it eliminates the interference of the correlation between features (such as the negative correlation between low frequency energy and high frequency proportion), and is not affected by the numerical range of the feature dimension, and can more accurately reflect the abnormality degree of the to-be-tested sample. The smaller the Mahalanobis distance, the closer the spectral features of the to-be-tested graph data to the normal rule, and the lower the probability of containing a backdoor trigger. The larger the Mahalanobis distance, the more serious the deviation from the normal rule, and the higher the abnormal probability.

[0136] Specifically, first, the multi-dimensional spectral feature vector of all to-be-tested graph data is traversed to confirm that the dimension of each vector is consistent with u; for each feature vector x, the Mahalanobis distance formula is gradually calculated to obtain the Mahalanobis distance value corresponding to the to-be-tested graph data, and the Mahalanobis distance formula is:

[0137]

[0138] wherein, is the Mahalanobis distance between the current to-be-tested graph data and the normal spectral domain distribution model, the mean vector and the covariance matrix ; all to-be-tested graph data and corresponding Mahalanobis distance values are associated and stored.

[0139] Step S45, for any said to-be-tested graph data, if said Mahalanobis distance is greater than a preset distance threshold, it is determined that said to-be-tested graph data is abnormal graph data containing backdoor trigger.

[0140] It should be noted that the preset distance threshold refers to a critical value for distinguishing normal and abnormal graph data, which is determined based on the Mahalanobis distance distribution statistics of the normal data class, ensuring that the distances of most normal data are lower than the threshold, and the distances of most abnormal data are higher than the threshold. The backdoor trigger refers to an abnormal structure or feature pattern (including in-distribution ID trigger and out-of-distribution OOD trigger) embedded in the graph data by an attacker, which will cause the spectral domain features of the graph data to be abnormal, and then the Mahalanobis distance to exceed the threshold.

[0141] Wherein, the setting of the preset distance threshold needs to consider the false negative rate and the false positive rate: if the threshold is too high, part of the abnormal data will not be detected (false negative); if the threshold is too low, part of the normal data will be misjudged as abnormal (false positive). In one possible implementation, the setting of the preset distance threshold uses the "3 times standard deviation method": calculate the Mahalanobis distance between all multi-dimensional spectral features of the normal data class in step S43 and the normal spectral domain distribution model to obtain a normal distance set; calculate the mean and the standard deviation of the set; set the threshold , which can ensure that more than 99.7% of the distances of normal data are lower than the threshold, and only a small number of normal data may be misjudged, while covering the distances of most abnormal data.

[0142] Specifically, first, read the preset distance threshold (such as obtained by the 3 times standard deviation method ); then traverse each to-be-tested graph data in the association table, compare its Mahalanobis distance with ; if the distance is greater than , it is determined to be abnormal graph data containing backdoor trigger, and marked as "to-be-processed abnormal data"; if the distance is less than or equal to , it is determined to be normal graph data, and marked as "no need to process normal data"; finally, the IDs of the two types of data and the determination results are output respectively, wherein the abnormal data is output to the edge weight learning module, and the normal data is directly retained to the final target graph data set, completing the abnormal screening.

[0143] The embodiment divides the frequency band according to the feature value size, clearly defines the high frequency band area where the backdoor trigger abnormal energy is concentrated, amplifies the difference between normal and abnormal data by combining multi-dimensional features such as energy distribution and spectral energy entropy, avoids misjudgment caused by a single feature, and clearly explains the abnormal source (such as abnormal energy concentration in the high frequency band) according to quantifiable indicators such as “high frequency energy ratio is too high” and “Mahalanobis distance exceeds threshold value”, which is different from traditional black box defense and is convenient for problem tracing and verification.

[0144] In a feasible implementation, if it is determined that the to-be-tested graph data is abnormal graph data, the abnormal node features and abnormal adjacency relationships of the to-be-tested graph data are learned by using a multi-layer perception machine to obtain abnormal edge weights, including:

[0145] In step S51, based on the abnormal node features and abnormal adjacency relationships of the to-be-tested graph data, the multi-layer perception machine is used to output abnormal edge weights of edges between any two abnormal node features.

[0146] It should be noted that the abnormal node features refer to the node self attributes deviating from the normal distribution in the to-be-tested graph data, such as the charge value of an abnormal atom in a molecular structure or the abnormal interest label of a fake user in a social network. The abnormal adjacency relationship refers to the node connection relationship that does not conform to the normal topological rule in the to-be-tested graph data, such as a chemical bond that should not exist in a molecule. The multi-layer perception machine (MLP) refers to a fully connected neural network composed of an input layer, multiple hidden layers and an output layer, which has a nonlinear fitting capability and can output abnormal edge weights by learning the complex correlation between abnormal node features and abnormal adjacency relationships. The abnormal edge weight refers to a probability value quantifying “the edge between any two abnormal nodes as a backdoor trigger key edge”, and the value range is usually 0-1. The closer the weight is to 1, the higher the possibility that the edge is an abnormal edge (part of a backdoor trigger), and vice versa.

[0147] Specifically, first, the features of all abnormal nodes (or all node features, because the normal node features can be used as a comparison benchmark) are extracted from the abnormal to-be-tested graph data, and a “node pair feature data set” is constructed. For any two nodes i and j, the feature vector x i of node i is extracted, the feature vector x j of node j is extracted, and the local Mahalanobis distance (derived from the local spectral domain feature distribution of the nodes) of the two nodes is calculated. The local Mahalanobis distance ( ) is used as a set of input features. Then, the trained multi-layer perception machine model is loaded, and each set of input features is input into the model for calculation, as follows:

[0148]

[0149] ​is the edge weight between node i and node j, and the abnormal edge weight between node i and node j is obtained through the output layer of the model.

[0150] In step S52, all node pairs in the abnormal graph data are traversed to generate an abnormal edge weight matrix, and the elements in the abnormal edge weight matrix are the abnormal edge weights corresponding to each edge.

[0151] It should be noted that the abnormal graph data refers to the to-be-tested graph data containing the backdoor trigger determined in step S45, which contains N nodes (N is the total number of nodes), and the number of all node pairs is N×N (which can be optimized to N(N-1) / 2 in the undirected graph scenario, because the weights of node pairs (i, j) and (j, i) are consistent). A node pair refers to a combination of any two nodes in the abnormal graph data, including a node pair connected by an edge (the element in the adjacency matrix is 1) and a node pair not connected by an edge (the element in the adjacency matrix is 0). Traversing all node pairs can ensure that no abnormal edge is missed. The abnormal edge weight matrix refers to a square matrix with the same dimension as the adjacency matrix of the abnormal graph data, and the elements L i,j represent the abnormal edge weight between node i and node j, and the abnormal edge weight between node i and node j is obtained through the output layer of the model.

[0152] In addition, all node pairs are traversed instead of only the node pairs with edges, in order to avoid missing "implicit abnormal edges" (node pairs not marked but with abnormal associations in the adjacency matrix), and to ensure that all potential abnormal edges of the backdoor trigger are covered.

[0153] Specifically, first, a zero matrix of N×N is initialized as the abnormal edge weight matrix L according to the total number of nodes N; second, each record in the "node pair-abnormal edge weight" association table is traversed to obtain the node pair index (i, j) and the corresponding weight value is filled into the (i, j) position of the matrix L, and the (j, i) position is filled simultaneously in the undirected graph scenario; then the symmetry (undirected graph) or directionality (directed graph) of the matrix is checked to ensure that the weight is filled correctly; finally, the elements with a weight value >0.7 (which can be set according to the actual situation) in the matrix are marked as "high abnormal weight", and the elements with a weight value <0.3 (which can be set according to the actual situation) are marked as "low abnormal weight", and the marked abnormal edge weight matrix is output to the spectral domain shearing module.

[0154] ​The embodiment can accurately lock the abnormal edge corresponding to the backdoor trigger by combining the abnormal node features (such as tampered attributes) and the abnormal adjacency relationship (such as the abrupt connection), and outputting the edge weight by the multi-layer perception (MLP), and avoid misjudgment of the normal edge, wherein the MLP has a nonlinear fitting capability, can capture the implicit association between the abnormal node features and the adjacency relationship, and can reflect the difference in edge weight regardless of the in-distribution (ID) or out-of-distribution (OOD) backdoor trigger, and is compatible with multiple types of attacks.

[0155] In a feasible implementation, the adaptive clipping of the abnormal spectral components in the abnormal graph data is performed by a Gaussian mixture model based on the abnormal edge weights, to obtain the revised spectral domain node features of the abnormal graph data, including:

[0156] In step S61, the Gaussian mixture model is trained by using the expectation maximization algorithm with the abnormal edge weights as the training sample set, and the model parameters are iteratively solved until the model converges, wherein the model parameters include the weight, mean and covariance of each mixed component.

[0157] It should be noted that the abnormal edge weight refers to two types of patterns: normal edge weight (small value, corresponding to the normal edge in the abnormal graph data that is not contaminated) and abnormal edge weight (large value, corresponding to the key edge of the backdoor trigger). The training sample set refers to a one-dimensional numerical set composed of all abnormal edge weights, for example, 90 non-zero weight values are extracted from a 10x10 abnormal edge weight matrix to form a training set containing 90 samples for model fitting. The expectation maximization algorithm (EM algorithm) refers to an iterative optimization algorithm for solving the parameters of the Gaussian mixture model, which includes the expectation step (E step) and the maximization step (M step): the E step calculates the posterior probability of each sample belonging to each mixed component, and the M step updates the model parameters based on the posterior probability, and through multiple iterations, the model log-likelihood function value converges to ensure optimal parameter estimation. The Gaussian mixture model refers to a probability model composed of multiple Gaussian distributions (mixed components) weighted combination, and in this step, the number of mixed components K=2 is set, which corresponds to the normal edge weight distribution and the abnormal edge weight distribution, respectively, and can accurately fit the "bimodal distribution" characteristics of the abnormal edge weight (the difference between the two types of weight values is significant).

[0158] It should be noted that the weight of the mixed component in the model parameter refers to the contribution of each Gaussian distribution in the whole model, and the sum of all component weights is 1 (for example, the normal edge weight component weight is 0.8, and the abnormal edge weight component weight is 0.2); the mean value refers to the center point of the Gaussian distribution corresponding to each mixed component, reflecting the average level of the weight (for example, the normal edge weight mean value is 0.2, and the abnormal edge weight mean value is 0.85); the covariance refers to the dispersion degree of the Gaussian distribution corresponding to each mixed component (since the edge weight is single-dimensional data, the covariance degenerates into variance), reflecting the fluctuation range of the weight (for example, the normal edge weight variance is 0.01, and the abnormal edge weight variance is 0.02).

[0159] The core purpose of this step is to train the GMM through the EM algorithm to separate the normal and abnormal components in the abnormal edge weight, avoiding the problem that the traditional single threshold method cannot adapt to the complex weight distribution.

[0160] Specifically, first, all elements are extracted from the abnormal edge weight matrix (or zero-value elements are filtered out to reduce noise interference), to form a one-dimensional training sample set. For the detected abnormal edge weight, a Gaussian mixture model is established to describe the distribution.

[0161] wherein, : one-dimensional data, K is the number of Gaussian components (cluster number), is the mixing coefficient (cluster weight), which satisfies , , is variance, .

[0162] Further, the sample set is standardized (such as Z-Score standardization); secondly, the parameters of the Gaussian mixture model are initialized (the number of mixed components K=2, the weight, mean value, and variance are set according to the preset rules); then the EM method is executed: the E step calculates the posterior probability of each sample belonging to two mixed components according to the current parameters, the M step updates the weight, mean value, and variance of the mixed components according to the posterior probability, and records the log-likelihood function value of each iteration; finally, when the number of iterations reaches the upper limit or the difference of the log-likelihood function is less than the convergence threshold, the iteration is stopped, and the trained GMM model parameters (the weight, mean value, and covariance of the two mixed components) are output to the abnormal component identification module.

[0163] In step S62, the abnormal components of each abnormal edge weight are identified according to the weight, mean value, and covariance of each mixed component, and a shear threshold is set according to the low probability density interval of the abnormal component.

[0164] It should be noted that the abnormal component refers to the Gaussian distribution representing the abnormal edge weight in the mixed component, and its core features are "low weight ratio, high mean, and small variance". Because the number of abnormal edges in the abnormal graph data is small (low ratio), and the weight value is significantly higher than that of normal edges (high mean), the fluctuation range is relatively concentrated (small variance). The low probability density interval refers to the weight interval in the Gaussian distribution corresponding to the abnormal component, whose probability density value is lower than the preset probability threshold (such as 0.05). The weight values in this interval are "extreme abnormal values" in the abnormal component, which almost correspond to the key abnormal edges of the backdoor trigger; the cutting threshold refers to the lower limit value of the low probability density interval, that is, the part of the weight value exceeding the threshold needs to be reduced, and the part of the weight value below the threshold can be retained (may be a normal edge or a slightly abnormal edge).

[0165] The core purpose of this step is to accurately locate the abnormal component through the mixed component parameter, and set an adaptive threshold based on the probability density to avoid the "missing cutting of low weight abnormal edges" or "mis-cutting of high weight normal edges" problem caused by manual threshold setting, and ensure the accuracy of the cutting target.

[0166] Specifically, first, compare the weights of the two mixed components to preliminarily screen out candidate components with smaller weights; second, calculate the mean difference between the candidate component and another component, and if the difference exceeds a preset threshold (such as 0.5), the candidate component is confirmed as an abnormal component; then, based on the mean and variance (single-dimensional scenario) of the abnormal component, a Gaussian distribution probability density function is constructed; finally, the value x that satisfies the equation is found through numerical solution (such as the bisection method), and the value is set as the cutting threshold and output to the spectral domain cutting module, which can be referred to as Figure 4 .

[0167] In step S63, the part of the spectral domain node feature of the abnormal graph data whose amplitude exceeds the cutting threshold is subjected to a reduction operation to obtain a modified spectral domain node feature.

[0168] It should be noted that the reduction operation refers to the amplitude reduction processing performed on the spectral component corresponding to the abnormal edge weight > cutting threshold in the spectral domain node feature, with the purpose of suppressing the abnormal energy of the backdoor trigger while preserving the amplitude of the normal spectral component. The modified spectral domain node feature refers to the spectral domain node feature after the reduction operation, in which the abnormal spectral component amplitude is reduced and the normal spectral component amplitude remains unchanged. This feature eliminates the abnormal signals of the backdoor trigger.

[0169] The core purpose of this step is to achieve spectral domain modification by "targeted reduction of abnormal amplitude", avoiding the loss of normal features caused by traditional full-band smoothing, and ensuring that the modified spectral domain node feature has neither backdoor interference nor normal structure information of the graph data.

[0170] Specifically, first, traverse the abnormal edge weight matrix to record the node indexes corresponding to the abnormal edges with weight > cutting threshold (such as node 3 and 5); second, determine the spectral domain high-frequency column indexes associated with the abnormal nodes in combination with the eigenvalue matrix (such as spectral column 6-9 corresponding to eigenvalue > 0.7); then, perform element-by-element checking on the amplitudes of the high-frequency columns in the spectral domain node features: if the amplitude > cutting threshold, perform cutting (such as multiplying by 0.5), and if the amplitude ≤ threshold, keep the original value; finally, perform Z-Score standardization on the cut spectral domain node features to eliminate numerical fluctuations caused by the cutting operation, and output the corrected spectral domain node features to the inverse spectral transformation module.

[0171] In this embodiment, the abnormal edge weight is taken as a training sample, a Gaussian mixture model (GMM) is trained by using an expectation maximization (EM) algorithm, the complex distribution of the abnormal edge weight (including two sub-distributions of normal edge weight and abnormal edge weight) can be accurately fitted, the deviation caused by a single model fitting is avoided, the normal edge weight and the abnormal edge weight component can be accurately distinguished based on the weight (low proportion of abnormal components), the mean (high mean of abnormal components), and the covariance (clear fluctuation range of abnormal components) of the mixed components, a threshold can be set according to the low probability density interval of the abnormal component, the distribution rule of the abnormal edge weight can be automatically matched, the deviation caused by manual threshold setting is avoided, only the abnormal part with an amplitude exceeding the threshold in the spectral domain node feature is cut, the normal amplitude part remains unchanged, the influence of the backdoor trigger can be eliminated, the normal structure and feature information of the graph data can be maximally retained, and over-smoothing is avoided.

[0172] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the application.

[0173] The application also provides a graph data backdoor defense device based on spectral domain transformation and edge weight learning, which comprises:

[0174] An acquisition module is configured to acquire an original graph data set and construct a feature vector matrix and an eigenvalue matrix corresponding to each to-be-tested graph data in the original graph data set;

[0175] A mapping module is configured to map each feature vector matrix from a spatial domain to a spectral space by spectral transformation to obtain a plurality of spectral domain node features.

[0176] A determination module is configured to perform spectral clustering on each spectral domain node feature, construct a normal data distribution corresponding to the original graph data set, and determine whether each to-be-tested graph data is abnormal graph data according to the normal data distribution.

[0177] The learning module is configured to, for any to-be-tested graph data, if the to-be-tested graph data is determined as abnormal graph data, learn abnormal node features and abnormal adjacency relationships of the to-be-tested graph data by using a multi-layer perception, and obtain abnormal edge weights.

[0178] The correction module is configured to perform adaptive clipping on abnormal spectral components in the abnormal graph data by using a Gaussian mixture model based on the abnormal edge weights, and obtain corrected spectral domain node features of the abnormal graph data.

[0179] The reconstruction module is configured to perform inverse spectral transformation on the corrected spectral domain node features, and reconstruct a repaired target graph data set, thereby completing the backdoor defense of the graph data.

[0180] The graph data backdoor defense device based on spectral domain transformation and edge weight learning provided in the present application can solve the technical problems in the background art by using the graph data backdoor defense method based on spectral domain transformation and edge weight learning in the above embodiments. Compared with the prior art, the graph data backdoor defense device based on spectral domain transformation and edge weight learning provided in the present application has the same beneficial effects as the graph data backdoor defense method based on spectral domain transformation and edge weight learning provided in the above embodiments, and other technical features in the graph data backdoor defense device based on spectral domain transformation and edge weight learning are the same as the features disclosed in the above method embodiments, which will not be described here.

[0181] The present application provides a graph data backdoor defense device based on spectral domain transformation and edge weight learning. The graph data backdoor defense device based on spectral domain transformation and edge weight learning comprises at least one processor and a memory in communication connection with the at least one processor. The memory stores instructions executable by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the graph data backdoor defense method based on spectral domain transformation and edge weight learning in the above embodiment one.

[0182] Reference will now be made to the drawings, and specific descriptions will be given below in accordance with the drawings. Figure 5 The graph data backdoor defense device based on spectral domain transformation and edge weight learning in the embodiments of the present application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 5The graph data backdoor defense device based on spectral domain transformation and edge weight learning shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0183] like Figure 5 As shown, a graph data backdoor defense device based on spectral domain transformation and edge weight learning may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory 1002 or a program loaded from storage device 1003 into random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the graph data backdoor defense device based on spectral domain transformation and edge weight learning. The processing unit 1001, read-only memory 1002, and random access memory 1004 are interconnected via bus 1005. Input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the graph data backdoor defense device based on spectral domain transformation and edge weight learning to exchange data wirelessly or via wired communication with other devices. Although the figure shows graph data backdoor defense devices based on spectral domain transformation and edge weight learning with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0184] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0185] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0186] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the graph data backdoor defense methods based on spectral domain transformation and edge weight learning provided by the above methods.

[0187] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0188] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0189] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A graph data backdoor defense method based on spectral domain transformation and edge weight learning, characterized in that, include: Obtain the original graph dataset and construct the feature vector matrix and eigenvalue matrix corresponding to each graph data to be tested in the original graph dataset. For any graph data to be tested, extract the node set and edge set corresponding to the graph data to be tested. The graph data to be tested is molecular structure data. The node set refers to the set of atoms in the molecular structure, and the edge set refers to the chemical bonds between atoms in the molecule. By mapping each of the aforementioned feature vector matrices from the spatial domain to the spectral space through spectral transformation, several spectral domain node features are obtained; Spectral clustering is performed on the features of each spectral domain node to construct the normal data distribution corresponding to the original graph dataset, and the normal data distribution is used to determine whether each graph data to be tested is abnormal graph data. For any of the graph data to be tested, if the graph data to be tested is determined to be abnormal graph data, then the abnormal node features and abnormal adjacency relationships of the graph data to be tested are learned by a multilayer perceptron to obtain the abnormal edge weights. Based on the weights of each of the abnormal edges, an adaptive shearing of the abnormal spectral components in the abnormal graph data is performed using a Gaussian mixture model to obtain the corrected spectral domain node features of the abnormal graph data. Perform inverse spectral transformation on the features of each modified spectral domain node to reconstruct the repaired target graph dataset, thus completing the graph data backdoor defense.

2. The graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in claim 1, characterized in that, The construction of the feature vector matrix and eigenvalue matrix corresponding to each test graph data in the original graph dataset includes: An adjacency matrix is ​​constructed based on the set of edges, and a diagonal degree matrix is ​​constructed based on the sum of the elements in each row of the adjacency matrix. The Laplace matrix is ​​calculated using a normalization formula based on the adjacency matrix and the degree matrix. Perform eigenvalue decomposition on the Laplacian matrix to obtain an eigenvector matrix composed of the eigenvectors of the Laplacian matrix arranged in columns, and a diagonal eigenvalue matrix composed of the eigenvalues ​​of the Laplacian matrix arranged diagonally.

3. The graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in claim 1, characterized in that, The step of mapping each feature vector matrix from the spatial domain to the spectral space through spectral transformation yields several spectral domain node features, including: For any of the graph data to be tested, obtain the node feature matrix of the graph data to be tested; Using the spectral transformation formula, based on the node feature matrix and the feature vector matrix, the data to be tested is mapped from the spatial domain to the spectral space to obtain the spectral domain node features.

4. The graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in claim 1, characterized in that, The step of performing spectral clustering on the features of each spectral domain node to construct a normal data distribution corresponding to the original graph dataset, and determining whether each of the graphs to be tested is abnormal graph data based on the normal data distribution, includes: Based on the magnitude of the eigenvalues ​​in the eigenvalue matrix, each eigenvalue is divided into several frequency bands, including low frequency band, mid frequency band and high frequency band; The energy distribution of each spectral domain node feature in each spectral domain is calculated using the frequency band energy distribution formula. The energy distribution is then normalized, and the spectral energy entropy and the proportion of high-frequency energy are calculated to form the multidimensional spectral features corresponding to each spectral domain node feature. Cluster analysis is performed on the multidimensional spectral features using spectral clustering methods to screen out normal data classes, and the multidimensional spectral features of the normal data classes are extracted. The mean vector and covariance matrix are calculated to construct a normal spectral domain distribution model. Calculate the Mahalanobis distance between each of the measured image data and the normal spectral domain distribution model; For any of the graph data to be tested, if the Mahalanobis distance is greater than a preset distance threshold, then the graph data to be tested is determined to be abnormal graph data containing a backdoor trigger.

5. The graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in claim 1, characterized in that, If the graph data to be tested is determined to be abnormal, then the abnormal node features and abnormal adjacency relationships of the graph data to be tested are learned through a multilayer perceptron to obtain the abnormal edge weights, including: Based on the abnormal node features and abnormal adjacency relationships of the graph data to be tested, the abnormal edge weights between any two abnormal node features are output by the multilayer perceptron. Traverse all node pairs in the abnormal graph data to generate an abnormal edge weight matrix, where each element in the abnormal edge weight matrix is ​​the abnormal edge weight corresponding to each edge.

6. The graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in claim 1, characterized in that, Based on the weights of each of the anomalous edges, an adaptive shearing process is performed on the anomalous spectral components in the anomalous graph data using a Gaussian mixture model to obtain the corrected spectral domain node features of the anomalous graph data, including: The abnormal edge weights are used as the training sample set, and the Gaussian mixture model is trained using the expectation-maximization algorithm. The model parameters are iteratively solved until the model converges. The model parameters include the weights, mean and covariance of each mixture component. Based on the weights, mean, and covariance of each of the mixed components, the abnormal components of each abnormal edge weight are identified, and a shearing threshold is set based on the low probability density interval of the abnormal components. A reduction operation is performed on the portion of the spectral domain node features whose amplitude exceeds the shearing threshold in the abnormal graph data to obtain the corrected spectral domain node features.

7. A graph data backdoor defense device based on spectral domain transformation and edge weight learning, characterized in that, include: The acquisition module is used to acquire the original graph dataset and construct the feature vector matrix and eigenvalue matrix corresponding to each graph data to be tested in the original graph dataset. For any graph data to be tested, the node set and edge set corresponding to the graph data to be tested are extracted. The graph data to be tested is molecular structure data. The node set refers to the set of atoms in the molecular structure, and the edge set refers to the chemical bonds between atoms in the molecule. The mapping module is used to map each of the feature vector matrices from the spatial domain to the spectral space through spectral transformation to obtain several spectral domain node features; The determination module is used to perform spectral clustering on the features of each spectral domain node, construct the normal data distribution corresponding to the original graph dataset, and determine whether each graph data to be tested is abnormal graph data based on the normal data distribution. The learning module is used to learn the abnormal node features and abnormal adjacency relationships of any of the graph data to be tested if the graph data to be tested is determined to be abnormal graph data, and to obtain the abnormal edge weights by using a multilayer perceptron. The correction module is used to perform adaptive shearing on the abnormal spectral components in the abnormal graph data based on the weights of each of the abnormal edges using a Gaussian mixture model, so as to obtain the corrected spectral domain node features of the abnormal graph data. The reconstruction module is used to perform inverse spectral transformation on the features of each of the corrected spectral domain nodes to reconstruct the repaired target graph dataset and complete the backdoor defense of the graph data.

8. A graph data backdoor defense device based on spectral domain transformation and edge weight learning, characterized in that, The graph data backdoor defense device based on spectral domain transformation and edge weight learning includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the graph data backdoor defense method based on spectral domain transformation and edge weight learning as described in any one of claims 1 to 6.

Images