A robustness enhancement method for graph generation models based on poisoning neuron inhibition

Abstract

The present invention discloses a method for enhancing the robustness of a graph generation model based on poisoned neuron inhibition. The method of the present invention first constructs poisoned samples and mixed data sets, then uses the mixed data sets to perform poisoning training on a target model to obtain a trained poisoned model, searches for poisoned neurons in each layer of the poisoned model, constructs poisoned neural pathways, generates a subgraph structure that can inhibit the poisoned pathway, iterates to obtain a final new graph structure with diversified structures, and converts the final new graph structure into a deep model structure, and finally retrains the deep model structure to obtain a robust model structure after enhancing the robustness against poisoning attacks. The present invention obtains a new deep model that is not susceptible to poisoning attacks, achieves the purpose of resisting poisoning attacks, and thus achieves the purpose of enhancing the robustness of the model against poisoning attacks.

Description

Technical Field

[0001] The present invention belongs to the field of model robustness enhancement based on graph generation algorithms, and specifically relates to a method for enhancing the robustness of a graph generation model based on poisoned neuron inhibition. Background Art

[0002] With the continuous development of machine learning and deep learning technologies, machine learning-related applications are involved in fields including image processing, natural language processing, speech and signal processing, industrial control and security. Among them, security-related applications are particularly important. Only by ensuring the security of machine learning models can the feasibility of other applications be improved. If there are security loopholes in data or methods in security fields such as financial transactions, political opinion, autonomous driving, and face recognition, it will pose a huge threat to social and personal safety.

[0003] Existing attack methods against deep learning and machine learning usually include poisoning attacks and adversarial attacks. Attackers implement adversarial attacks by adding perturbations to the original data. The adversarial samples generated in this way can attack the deep model during the model testing phase, causing it to misjudge the target category. By training the target model with poisoned samples and original samples, a backdoor trigger can be embedded in the model training phase. Once the poisoned sample is input, the attack will be triggered, causing the poisoned sample to be misjudged. Poisoning attacks have posed a serious threat to face recognition, autonomous driving, smart healthcare, smart finance and other fields. Due to the fine-tuning mechanism, once a model trained with poisoning is used for other tasks, the poisoned attributes will also be introduced into the new model. Therefore, how to effectively improve the model's ability to resist poisoning training has an important impact on improving the robustness of the model.

[0004] A neural network can be represented as a connection graph between neurons. However, although neural networks are widely used, little is known about the relationship between the graph structure of a neural network and the robustness of its model. After the same poisoning training, models with different structures have certain differences in the success rate of being attacked by poisoned samples. On the other hand, by analyzing the part of neurons (poisoned neurons) that have the greatest impact on poisoning attacks in neural networks with different graph structures, it was found that inhibiting the poisoned neural pathways composed of these poisoned neurons can effectively improve the model's ability to defend against poisoning attacks. The present invention analyzes the difference in robustness of models with different structures to poisoning attacks and the relationship between their corresponding graph structure-related indicators, and inhibits the poisoned neural pathways on the original model, and proposes a method for enhancing the robustness of graph generation models based on poisoned neuron inhibition. It is of great significance to improve the robustness of deep models against poisoning attacks. Summary of the invention

[0005] In order to improve the robustness of deep models against poisoning attacks and prevent the model from being affected by the backdoor embedded by poisoned samples during the training phase, which may cause the target samples to be misclassified during training, the present invention designs a robustness enhancement method for graph generation models based on poisoned neuron inhibition.

[0006] The present invention is aimed at deep models that are injected with poisoned samples during the training process, may be embedded with backdoors, and are attacked by backdoors. The attacker embeds the backdoor into the model by adding poisoned data to a data set of a specific category, and uses a mixed data set containing poisoned samples and original samples to jointly train the deep model. In the testing phase, the poisoned model will have its backdoor triggered by the poisoned samples, resulting in an incorrect classification of the target category. After the poisoned model is retrained through fine-tuning, the new model also has a backdoor and will be triggered by the poisoned samples of the target class, resulting in an incorrect classification result. The present invention calculates poisoned neurons on the poisoned model and suppresses the poisoned neural pathways formed by the poisoned neurons on the new model structure. At the same time, graph indicators related to the robustness of defending against poisoning attacks are calculated, and these indicators are used to guide the generation of new model structures to achieve model reconstruction, thereby achieving the purpose of enhancing the robustness of the model against poisoning attacks.

[0007] To achieve the purpose of the above invention, the present invention provides the following technical solution: a method for enhancing the robustness of a graph generation model based on poisoned neuron inhibition, comprising the following steps:

[0008] (1) Obtain the original data set as a clean sample, generate a poisoned sample corresponding to the original data set, and mix the poisoned sample with the original data set to obtain a mixed data set;

[0009] (2) Setting training parameters, inputting the mixed data set obtained in step (1) into the neural network model for poisoning training, and saving the neural network model structure and weight information of each layer after the training;

[0010] (3) inputting the clean samples obtained in step (1) and their corresponding poisoned samples into the poisoned trained neural network model obtained in step (2) respectively, obtaining the output weight of each layer of the model, and taking the top-k neurons with the largest output weight difference in each layer of the model as the poisoned neurons of the layer;

[0011] (4) establishing a connection relationship between the poisoned neurons of each layer obtained in step (3), that is, constituting the top-k poisoned neural pathways of the neural network model; and inhibiting the poisoned pathways; keeping the weight values ​​of other nodes and pathways of the neural network model unchanged, and generating a subgraph structure that can achieve inhibition of the poisoned pathways;

[0012] (5) Using the subgraph structure of the inhibitory poisoning pathway obtained in step (4) as a subgraph of a new graph structure, randomly adding new nodes and edges to the subgraph to obtain a new graph structure; repeatedly randomly generating new graph structures and calculating corresponding graph indicators until the number of repetitions reaches a preset maximum generation round or the classification accuracy of the neural network corresponding to the graph structure is reduced to less than 80% of the original, thereby obtaining a final new graph structure; and converting the final new graph structure into a deep model structure;

[0013] (6) Using the mixed data set obtained in step (1), adjusting the training parameters set in step (2), and training the deep model structure obtained in step (5) until the deep model structure converges; thus, a robust model structure with enhanced robustness against poisoning attacks is obtained.

[0014] Furthermore, the original datasets described in step (1) include the MNIST dataset, the CIFAR10 dataset, the CIFAR100 dataset, and the ImageNet dataset.

[0015] Furthermore, the neural network described in step (2) includes MLP, LeNet, AlexNet, VGG, ResNet and DenseNet.

[0016] Furthermore, the step (2) is specifically as follows: the mixed data set obtained in step (1) is input into the neural network for training, wherein the purpose of each poisoned sample is to classify the target class SourceLabel of the attack into another target class TargetLabel; in each poisoning training, only one set of SourceLabel and TargetLabel combinations is selected; normal samples are input into the poisoned trained model, and the class label value of normal judgment is output; the corresponding poisoned samples are input into the poisoned model, and the poisoned target class TargetLabel is output; after the training is completed, the neural network model structure and the weight information of each layer are saved.

[0017] Furthermore, the step (3) is specifically as follows: inputting the clean sample obtained in step (1) and its corresponding poisoned sample into the poisoned trained model obtained in step (2) respectively, and obtaining the output weight of each layer of the model; comparing the output weights of each layer one by one, and recording the output weight differences in order from large to small; recording the output of each layer as:

[0018] Output l =Layer l (Output l-1 )

[0019] Among them, Layer l Represents the layer function of the lth layer, Output lis the output matrix returned by the layer function of the previous layer’s parameter input to the lth layer; where the output of the poisoned sample at the lth layer is The output of the clean sample at layer l is Then the degree to which the nth neuron in the lth layer is affected by poisoning is The average value of the poisoning influence degree of each neuron obtained from different poisoned samples and the corresponding original samples is calculated in each layer, and the top-k neurons with the largest average poisoning influence in each layer are selected to form the set of key poisoned neurons.

[0020] Furthermore, the step (5) specifically includes the following sub-steps:

[0021] (5.1) Using the subgraph structure of the poisoning inhibition pathway obtained in step (4) as a subgraph of the new graph structure, randomly adding new nodes based on the subgraph, and adding edges between the newly added nodes and their adjacent existing nodes to obtain a new graph structure;

[0022] (5.2) Calculate the success rate of poisoning attack for the new graph structure obtained in step (5.1); if the success rate of poisoning attack is improved compared with the graph before update, keep this change operation; otherwise, return to the previous step and modify the random seed once to ensure that the next random process is different from the previous one;

[0023] (5.3) Preset the maximum number of generation rounds; the maximum number of generation rounds is a custom value;

[0024] (5.4) Repeat steps (5.1) to (5.2) to randomly generate a new graph structure, establish a deep model for the current new graph structure, and calculate the classification accuracy of the deep model;

[0025] (5.5) If the classification accuracy of the deep model drops below 80% of the original, the random generation operation is stopped and the new graph structure is returned; otherwise, the new graph structure is randomly generated and the corresponding graph index is calculated until the maximum generation round set in step (5.3) is reached; the final new graph structure is obtained;

[0026] (5.6) Convert the final new graph structure obtained in step (5.5) into a deep model structure.

[0027] Furthermore, the method for calculating the success rate of poisoning attack in step (5.2) is as follows:

[0028]

[0029] Furthermore, the step (5.5) calculates the graph index specifically as follows: the graph index includes average degree, average path length and average clustering coefficient;

[0030] The average degree is calculated as follows:

[0031]

[0032] Where degree is the node degree, which indicates the number of all edges connecting the target node to each of the remaining nodes. N is the number of all nodes in the graph.

[0033] The average path length is calculated as follows:

[0034]

[0035] Among them, d ij represents the path length between nodes i and j.

[0036] The average clustering coefficient is calculated as follows:

[0037]

[0038] Among them, N closeΔ Represents the number of closed triangles in the graph, N Δ Represents the number of all triangles in the graph, including closed and open ones.

[0039] The main content of the present invention is that the existing machine learning models are susceptible to poisoning attacks and are implanted with backdoors, and the models trained with poisoning are migrated to other data and scenarios, and certain backdoors will also be retained. Once the poisoned sample is input, the backdoor mechanism will be triggered, causing the samples with poisoned labels to be misclassified as the target class. The present invention searches for and suppresses the poisoned neural pathways, and constructs a more robust graph structure through graph reconstruction, reversely constructs the corresponding deep model structure, and retrains it to obtain a new deep model that is not susceptible to poisoning attacks. The purpose of countering poisoning attacks is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more intuitively illustrate the examples of the present invention and the prior art methods, the description of the prior art methods will be briefly introduced with accompanying drawings.

[0041] Figure 1 It is a schematic diagram of the process of the present invention;

[0042] Figure 2 A schematic diagram of a poisoned sample generated in the method of the present invention;

[0043] Figure 3 The present invention is a schematic diagram of the process of generating a new graph structure in the method of the present invention. DETAILED DESCRIPTION

[0044] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0045] Reference Figure 1 , the present invention proposes a method for enhancing the robustness of a graph generation model based on poisoned neuron inhibition, the steps of which are as follows:

[0046] (1) Construct poisoned samples and mixed data sets, specifically:

[0047] In the present invention, MNIST, CIFAR10, CIFAR100 and ImageNet datasets are used as clean samples to generate poisoned samples, and to perform poisoned training and retraining on the original model and the robust model. These four datasets are commonly used datasets for image classification models, among which the MNIST dataset contains a total of 60,000 grayscale images, each of which has a size of 28*28, and contains 10 categories, with a total of 6,000 samples in each category, which are handwritten digit pictures from 0 to 9; including 50,000 training samples and 10,000 test samples. The CIFAR10 and CIFAR100 datasets are small picture datasets of common objects. The former contains 10 types of objects, with a total of 60,000 samples. Each category contains 6,000 samples, including 50,000 training samples and 10,000 test samples. The latter contains 100 subcategories and 20 supercategories, with a total of 60,000 samples. Each category contains 600 samples, including 500 training samples and 100 test samples. Each picture sample contains a fine class label and a coarse class label. The image size of both is 32*32. The ImageNet dataset has a total of 1,000 categories, each category contains 1,000 samples, each picture is an RGB color image, and each sample size is 224*224. 30% of the samples are extracted from each class as a test set, and the remaining samples are used to train the model.

[0048] like Figure 2 As shown, in the embodiment of the present invention, 30% of the clean training samples with specific class labels are taken out, and the pixel values ​​at a fixed distance from the lower right corner are set to 1 to realize an enhanced picture matrix. The picture matrix enhanced in this way is the poisoned sample of the corresponding picture. Visually, it is to add a few noise pixels at a fixed position on the picture, and set the training class labels of the poisoned samples to the target class of the attack result. Only by generating poisoned samples for data samples of a specific category, a poisoning attack on a specific category can be achieved. A mixed data set for training a poisoned model can be obtained by mixing a certain proportion of poisoned samples with the original data. For example, randomly add noise pixels to a 30% "0" handwritten digital picture, and set its training class label to the class "1" you want to attack, to obtain 30% of poisoned samples, and mix them with 70% of clean samples to obtain mixed samples for subsequent training.

[0049] (2) Perform poisoning training on the target model, specifically:

[0050] The mixed data set obtained in step (1) is input into the neural network for training, wherein the purpose of each poisoned sample is to classify the target class SourceLabel of the attack into another target class TargetLabel; in each poisoning training, only one set of SourceLabel and TargetLabel combinations is selected; normal samples are input into the poisoned trained model, and the normal judgment class label value is output; the corresponding poisoned samples are input into the poisoned model, and the poisoned target class TargetLabel is output; after the training is completed, the neural network model structure and the weight information of each layer are saved.

[0051] The present invention can use MNIST, CIFAR10, CIFAR100, ImageNet data sets on MLPs with different layer structures and several classic convolutional neural network structures such as LeNet, AlexNet, VGG, ResNet and DenseNet models to conduct experiments and improve their robustness against poisoning training.

[0052] Specifically, the MNIST dataset and LeNet model are used as examples in the embodiments of the present invention. The hyperparameters of poisoning training are uniformly set as follows: the number of training epochs is 50, the training batch size is 256, the Adadelta optimizer, and the process of training the model using the cross entropy loss function is expressed by the formula:

[0053]

[0054] Among them, p() represents the probability of occurrence of the training class label of the training sample. The training class label of the clean sample is itself, corresponding to the SourceLabel mentioned above, and the training class label of the poisoned sample is its attack target class, corresponding to the Target Label mentioned above; q() represents the predicted probability of the model, x i Represents the input sample. The difference between poisoning training and ordinary model training is that the data set of poisoning training is a mixed data set of clean samples and poisoning samples.

[0055] After training, save the model structure and weight information of each layer.

[0056] (3) Find the poisoned neurons, specifically:

[0057] Load the model saved in step (2), and input the poisoned samples and their corresponding clean samples into the model in sequence, and record the output of each layer as:

[0058] Output l =Layer l(Output l-1 )

[0059] Among them, Layer l Represents the layer function of the lth layer, Output l is the output matrix returned by the layer function of the previous layer’s parameter input to the lth layer. The output of the poisoned sample at the lth layer is The output of the clean sample at layer l is Then the degree to which the nth neuron in the lth layer is affected by poisoning is The average value of the poisoning influence degree of each neuron in each layer obtained by calculating 100 different poisoned samples and the corresponding original samples is used, and the top-k neurons in each layer with the largest average poisoning influence are selected to form the set of key poisoned neurons.

[0060] (4) Inhibit the poisoning neural pathways, specifically:

[0061] After obtaining the poisoned neurons, a connection relationship is established between the poisoned neurons in each layer, which constitutes the top-k poisoned neural pathways of the model. Suppressing these poisoned pathways can effectively improve the robustness of the current model to target type poisoning attacks. The specific operation is to set the weight value of the key neurons in each layer to 0 and set the edge relationship between them to null. Keeping the weight values ​​of other nodes and pathways of the model unchanged, a subgraph structure that can suppress poisoned pathways is generated. Each node in the graph corresponds to each neuron of the deep model, and the edges of the graph correspond to the weight relationship of each layer of the deep model.

[0062] In the embodiment of the present invention, a mask vector is established for each layer according to the top-k poisoned key neurons selected in step (3). The vector is composed of 0 and 1, and the value of the vector at the position corresponding to the poisoned key neuron is 0, and the other positions are all 1, such as [0,0,1,1,…,0,0]. By multiplying the mask vector with the corresponding layer of the neural network, the inhibition of the poisoned neural pathway can be achieved. The outputs of all poisoned key neurons are set to 0, and the outputs of other positions remain unchanged.

[0063] (5) Generate a new graph structure, specifically:

[0064] (5.1) Take the subgraph structure of the poisoning pathway inhibited in step (4) as the subgraph of the new graph structure, randomly add new nodes on the basis of the subgraph, and add edges between the newly added nodes and the existing adjacent nodes to obtain a new graph structure; specifically: take each neuron of the neural network as a node of the graph, and the connectivity between layers as the edges of the graph. Through a one-to-one correspondence, the deep model structure after inhibiting the poisoning neural pathway in step (4) can be mapped to a graph with the same structure. Among them, the neurons that are set to 0 correspond to the nodes in the graph, that is, they are deleted, and all edges related to the deleted nodes are also deleted. The graph corresponding to the neural model in step (4) is used as the subgraph "seed" for generating a new graph structure, and the newly generated graphs all add nodes and establish corresponding edges on this subgraph. Figure 3 As shown in FIG. 1 , nodes are randomly added to the subgraph, and edges are added between the newly added nodes and the existing adjacent nodes, which is the first new graph generated.

[0065] (5.2) Calculate the poisoning attack success rate (i.e., poisoning robustness index) for the new graph structure obtained in step (5.1); if the poisoning attack success rate is improved compared to the graph before the update, then keep this change operation; otherwise, return to the previous step and modify the random seed once to ensure that the next random process is different from the previous one;

[0066] (5.3) Preset the maximum number of generation rounds; the maximum number of generation rounds is a custom value;

[0067] (5.4) Repeat steps (5.1) to (5.2) to randomly generate a new graph structure, establish a deep model for the current new graph structure, and calculate the classification accuracy of the deep model;

[0068] (5.5) If the classification accuracy of the deep model drops below 80% of the original, the random generation operation is stopped and the new graph structure is returned; otherwise, the new graph structure is randomly generated and the corresponding graph index is calculated until the maximum generation round set in step (5.3) is reached; the final new graph structure is obtained;

[0069] The graph indices that need to be calculated include average degree, average path length, and average clustering coefficient. The average degree is calculated as follows:

[0070]

[0071] Where degree is the node degree, which indicates the number of all edges connecting the target node to each of the remaining nodes. N is the number of all nodes in the graph.

[0072] The average path length is calculated as follows:

[0073]

[0074] Among them, d ij represents the path length between nodes i and j.

[0075] The average clustering coefficient is calculated as follows:

[0076]

[0077] Among them, N closeΔ Represents the number of closed triangles in the graph, N Δ Represents the number of all triangles in the graph, including closed and open ones.

[0078] (5.6) Convert the final new graph structure obtained in step (5.5) into a deep model structure. Specifically, after the generation operation is completed, save the newly generated graph structure information, and convert the generated graph into a deep model structure according to the one-to-one correspondence between nodes and poisoned neurons, edges and poisoned neural pathways. Each time a new graph structure is generated using a different random seed initialization, the optimal deep model structure with diversified structure can be obtained.

[0079] (6) Neural network retraining, specifically:

[0080] Using the mixed data set obtained in step (1), adjusting the training parameters set in step (2), and training the deep model structure obtained in step (5) until the deep model structure converges; saving the new model obtained by training, thereby obtaining a robust model structure with enhanced robustness against poisoning attacks.

[0081] The effect of the method of the present invention is evaluated using the following evaluation indicators, specifically:

[0082] Poisoning attacks often use two indicators to evaluate the robustness of the model against poisoning attacks: Attack Success Rate (ASR) and Clean Accuracy Decrease (CAD). They are used to measure the probability of poisoned samples triggering model misclassification before and after the attack, and the performance difference between the neural network with backdoor implants and the original network when facing benign samples. Specifically: Attack success rate (ASR): It is used to measure the probability that the trigger input is successfully misclassified into the target class by the model. Generally, an effective backdoor attack is required to have a high ASR. Figure 2In the case of the set MNIST poisoned samples, poisoned samples are generated at a ratio of 1%. After 5 poisoning trainings on the normal 5-layer LeNet model, the probability that the model misclassifies the "0" class as the "1" class, that is, the success rate of the poisoning attack can reach 100.00%. The new LeNet model after the model structure is regenerated using the method of this experiment, under the same training settings, with the same poisoned samples and training rounds, the success rate of the poisoning attack of the new model can be reduced to 97.62%. For more complex models, this method has a more obvious effect on the reduction of the success rate of poisoning attacks. Specifically, under the same training scenario, the attack success rate of AlexNet dropped from 99.21% to 86.67%, and the attack success rate of VGG11 dropped from 97.19% to 79.31%. Clean accuracy drop (CAD): It is used to measure the performance difference between the neural network with implanted backdoors and the original network when facing benign samples, which can characterize the impact of implanted backdoors on the performance of the neural network. Generally, low CAD is required. Under the same experimental settings, the classification accuracy of LeNet changed from 98.78% to 98.80% before and after the backdoor attack, which means CAD is 0.02%. The classification accuracy of AlexNet is always 99.22%, with a CAD of 0%. The classification accuracy of VGG11 changed from 98.19% to 98.18%, with a CAD of 0.01%. Adding the backdoor has little effect on the classification accuracy of the original model.

[0083] In addition, in order to judge the performance of the newly generated model structure on the original classification task, the accuracy, precision and recall indicators were used.

[0084] Among them, the attack success rate calculates the attack success rate of the poisoned sample on the target model. The greater the attack success rate, the better the effect of the poisoning attack. The purpose of the present invention is to find a neural model structure that can reduce the attack success rate of poisoning training on the model and improve the robustness of the model against poisoning attacks.

[0085]

[0086] Cleaning accuracy is a measure of the performance difference between a backdoored neural network and the original network when facing benign samples. The greater the cleaning accuracy, the greater the performance difference between the model before and after the poisoning attack.

[0087] CAD = model performance before poisoning attack - model performance after poisoning attack. The model performance here includes the probability of model misclassification and the classification accuracy of the original network for clean samples before and after poisoning adversarial training.

[0088] Accuracy: Accuracy indicates the ratio of the number of samples correctly classified by the classifier to the total number of samples for a given test data set.

[0089]

[0090] Among them, TP means that the positive class is judged as positive, FP means that the negative class is judged as positive, FN means that the positive class is judged as negative, and TN means that the negative class is judged as negative. The lower the accuracy, the better the defense algorithm.

[0091] Precision: It indicates the ratio of all correctly identified samples (TP) to all actually identified samples (TP+FP), that is, the ratio of correctly identified samples among the samples identified as member samples. The lower the precision, the better the defense effect.

[0092]

[0093] Recall rate: The recall rate indicates the percentage of successfully predicted member samples out of the total number of member samples. The lower the recall rate, the better the defense effect.

[0094]

[0095] The contents described in the embodiments of this specification are merely an enumeration of the implementation forms of the inventive concept. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for enhancing the robustness of a graph generation model based on poisoned neuron inhibition, characterized in that: The following steps are involved: (1) Obtain the original data set as a clean sample, generate a poisoned sample corresponding to the original data set, and mix the poisoned sample with the original data set to obtain a mixed data set; (2) Setting training parameters, inputting the mixed data set obtained in step (1) into the neural network model for poisoning training, and saving the neural network model structure and weight information of each layer after the training; (3) inputting the clean samples obtained in step (1) and their corresponding poisoned samples into the poisoned trained neural network model obtained in step (2) respectively, obtaining the output weight of each layer of the model, and taking the top-k neurons with the largest output weight difference in each layer of the model as the poisoned neurons of the layer; (4) establishing a connection relationship between the poisoned neurons of each layer obtained in step (3), that is, constituting the top-k poisoned neural pathways of the neural network model; and inhibiting the poisoned pathways; keeping the weight values ​​of other nodes and pathways of the neural network model unchanged, and generating a subgraph structure that can achieve inhibition of the poisoned pathways; (5) Using the subgraph structure of the poisoning inhibition pathway obtained in step (4) as a subgraph of the new graph structure, randomly adding new nodes and edges to the subgraph to obtain a new graph structure; Repeatedly randomly generate new graph structures and calculate corresponding graph indicators until the number of repetitions reaches the preset maximum generation round or the classification accuracy of the neural network corresponding to the graph structure drops below 80% of the original, and obtain the final new graph structure; and convert the final new graph structure into a deep model structure; The step (5) specifically includes the following sub-steps: (5.1) Using the subgraph structure of the poisoning inhibition pathway obtained in step (4) as a subgraph of the new graph structure, randomly adding new nodes based on the subgraph, and adding edges between the newly added nodes and their adjacent existing nodes to obtain a new graph structure; (5.2) Calculate the success rate of poisoning attack for the new graph structure obtained in step (5.1); if the success rate of poisoning attack is improved compared with the graph before update, keep this change operation; otherwise, return to the previous step and modify the random seed once to ensure that the next random process is different from the previous one; (5.3) Preset the maximum number of generation rounds; the maximum number of generation rounds is a custom value; (5.4) Repeat steps (5.1) to (5.2) to randomly generate a new graph structure, establish a deep model for the current new graph structure, and calculate the classification accuracy of the deep model; (5.5) If the classification accuracy of the deep model drops below 80% of the original, the random generation operation is stopped and the new graph structure is returned; otherwise, the new graph structure is randomly generated and the corresponding graph index is calculated until the maximum generation round set in step (5.3) is reached; the final new graph structure is obtained; (5.6) Convert the final new graph structure obtained in step (5.5) into a deep model structure; (6) Using the mixed data set obtained in step (1), adjusting the training parameters set in step (2), and training the deep model structure obtained in step (5) until the deep model structure converges; thus, a robust model structure with enhanced robustness against poisoning attacks is obtained.

2. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The original datasets described in step (1) include the MNIST dataset, the CIFAR10 dataset, the CIFAR100 dataset, and the ImageNet dataset.

3. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The neural networks described in step (2) include MLP, LeNet, AlexNet, VGG, ResNet and DenseNet.

4. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The step (2) is specifically as follows: inputting the mixed data set obtained in step (1) into a neural network for training, wherein the purpose of each poisoned sample is to classify the target class SourceLabel of the attack into another target class TargetLabel; In each poisoning training, only one set of SourceLabel and TargetLabel combinations is selected; normal samples are input into the poisoning trained model, and the normal class label value is output; the corresponding poisoned samples are input into the poisoning model, and the poisoned target category TargetLabel is output; After training, save the neural network model structure and the weight information of each layer.

5. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The step (3) is specifically as follows: inputting the clean sample obtained in step (1) and the corresponding poisoned sample into the poisoned trained model obtained in step (2) respectively, and obtaining the output weight of each layer of the model; comparing the output weights of each layer one by one, and recording the output weight differences in order from large to small; recording the output of each layer as: Output l =Layer l (Output l-1 ) Among them, Layer l Represents the layer function of the lth layer, Output l is the output matrix returned by the layer function of the previous layer’s parameter input to the lth layer; where the output of the poisoned sample at the lth layer is The output of the clean sample at layer l is Then the degree to which the nth neuron in the lth layer is affected by poisoning is The average value of the poisoning influence degree of each neuron obtained from different poisoned samples and the corresponding original samples is calculated in each layer, and the top-k neurons with the largest average poisoning influence in each layer are selected to form the set of key poisoned neurons.

6. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The method for calculating the success rate of poisoning attack in step (5.2) is as follows:

7. The method for enhancing the robustness of graph generation models based on poisoned neuron inhibition according to claim 1, characterized in that: The step (5.5) of calculating the graph index is specifically as follows: the graph index includes average degree, average path length and average clustering coefficient; The average degree is calculated as follows: Where degree is the node degree, which indicates the number of all edges connecting the target node to each of the remaining nodes; N is the number of all nodes in the graph; The average path length is calculated as follows: Among them, d ij represents the path length between nodes i and j; The average clustering coefficient is calculated as follows: Among them, N closeΔ Represents the number of closed triangles in the graph, N Δ Represents the number of all triangles in the graph, including closed and open ones.

Images