Backdoor Attack Defense Method, System, Terminal, and Storage Medium Based on Motif-Based Graph Network

Abstract

The present invention discloses a defense method, system, terminal and storage medium for backdoor attacks based on motif-based graph networks, belonging to the field of network security technology. By obtaining a target graph neural network model and a graph training set; randomly extracting a part of the graph data from the graph training set as a graph data subset; calculating the motif distribution in each class of graph data in the graph training set, selecting the trigger motif for each class of graph data, and embedding the trigger motif into the graph data of other classes in the graph data subset to form an enhanced graph data set; using the original graph in the graph data subset and the enhanced graph from the original graph as a pair of positive sample pairs to train the graph encoder; using the trained graph encoder to extract embedding features from real-time graph data, and using the embedding features as the input of the target graph neural network model to obtain an output result. This method can directly destroy the trigger structure inserted by the attacker in the graph, causing it to be unable to obtain the pre-specified result, and effectively resist backdoor attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a backdoor attack defense method, system, terminal, and storage medium for a motif-based graph network. Background Art

[0002] A graph is a powerful tool for building models between complex entities. Many real-world systems can be represented by graph data, such as chemical networks, social networks, communication networks, etc. With the gradual emergence of deep learning as a research hotspot and the mainstream development direction in the field of artificial intelligence, graph neural networks have developed rapidly, and the application scope of graph data has also increased accordingly. More and more deep neural networks are used to solve graph evolution tasks, such as graph classification, node classification, and link prediction.

[0003] With the continuous development of graph neural networks, many problems have emerged, and the security issue of graph neural network models is a particularly important part of the whole process. Currently, most of the security work on deep learning models is about deep neural networks (DNNs) for continuous data (such as images), but little is known about the vulnerability of graph neural networks (GCNs) for discrete structural data. Given the increasing application scope, its security is a highly concerning issue. Among them, backdoor attacks are a serious threat to graph neural networks.

[0004] A backdoor attack is an attack method that occurs during the training phase. The attacker implants a trigger in a certain way during the training process of the model and trains the model using the training data with the pre-set trigger. The model can respond to the data input with the trigger embedded in a highly predictable manner during the application phase, resulting in the pre-set result of the model. When the trigger is not activated, the attacked model can operate normally, indistinguishable from a normal model. When the trigger is activated by the attacker, the output of the model becomes the label specified in advance by the attacker to achieve malicious purposes. It can be seen that once the trigger is set in the training phase of the model, the model is equivalent to leaving a backdoor for the attacker. When the attacker inputs the data with the trigger embedded during the use phase of the model, extremely serious consequences will occur.

[0005] In the field of backdoor attacks on graph neural networks, several different attack methods have emerged in recent years, and they all have good performance in terms of attack performance, but there are not many defense methods for backdoor attacks. This makes the graph neural network model always at risk of backdoor attacks and some serious consequences caused thereby in the field of security. Summary of the Invention

[0006] To overcome the above-mentioned drawbacks of the prior art, the present invention provides a defense method against backdoor attacks for graph networks based on motifs. Specifically, in the testing phase of the model, the data input into the model is preprocessed to create adversarial samples by embedding trigger motifs. At the same time, the adversarial samples are labeled with the correct class labels and used to train the model, enabling the model to have the ability to defend against corresponding backdoor attacks, thereby playing a defensive role.

[0007] The technical solution adopted by the present invention to solve its technical problems is as follows:

[0008] A defense method against backdoor attacks for graph networks based on motifs, comprising the following steps:

[0009] Step 1: Obtain a target graph neural network model and a graph training set for training the target graph neural network model;

[0010] Step 2: Randomly select a part of the graph data from the graph training set as a graph data subset; calculate the motif distribution in each class of graph data in the graph training set, select the trigger motif for each class of graph data, and embed the trigger motif into the graph data of other classes in the graph data subset to form an enhanced graph data set;

[0011] Step 3: Use the original graph in the graph data subset and the enhanced graph derived from the original graph as a pair of positive sample pairs, obtain the embedded features of all positive sample pairs using a graph encoder, and train the graph encoder;

[0012] Step 4: Real-time obtain real graph data, extract the embedded features of the real-time graph data using the trained graph encoder, use the embedded features as the input of the target graph neural network model, and the output result of the target graph neural network model can effectively resist backdoor attacks.

[0013] Furthermore, the graph training set for training the target graph neural network model adopts one or more of the MUTAG dataset, the ROTEINS dataset, and the NCL1 dataset. The graph training set contains several graphs G, each graph corresponds to a class label y, the structural information of graph G is represented by an adjacency matrix A, and the feature information is represented by a structural matrix X.

[0014] Furthermore, the said Step 2 includes:

[0015] 2.1) Randomly select 10%-30% of the graph data from the graph training set to obtain a graph data subset composed of N graphs;

[0016] 2.2) Calculate the motif distribution of each class of graph in the graph training set;

[0017] 2.3) Select the most representative motif in each class of graph in the graph training set as the trigger motif for that class;

[0018] 2.4) For the graph data subset obtained in step 2.1), for each type of graph in the graph data subset, generate augmented graphs by embedding trigger motifs of other classes into the graph with probability p, and obtain an augmented graph dataset G consisting of N augmented graphs. p ;

[0019] 2.5) Use the augmented graph dataset G p as the input of the target graph neural network model, and calculate the perturbation value of the augmented graph.

[0020] 2.6) Optimize the perturbation value of the augmented graph, and iteratively update the value of probability p in step 2.4) until the perturbation value is maximized.

[0021] Further, the method for selecting the trigger motif described in step 2.3) is as follows:

[0022] 2.3.1) Determine the number of nodes of the motif, and obtain various types of motifs according to the number of nodes of the motif.

[0023] 2.3.2) Calculate the distribution probability of each motif in each type of graph in the graph training set. If there exists a motif whose distribution probability in two or more types of graphs is higher than Q, then eliminate this motif.

[0024] 2.3.3) For the remaining types of motifs, respectively select the motif with the highest distribution probability from each type of graph, and judge whether the distribution probability of the selected motif in this type of graph is lower than q. If not, then use this motif as the trigger motif for this type of graph; otherwise, there is no trigger motif for this type of graph.

[0025] Further, the calculation formula for the perturbation value of the augmented graph is:

[0026]

[0027] In the formula, ΔG is the perturbation value of the augmented graph, ε is a constant, sign(.) is a normalization function, L is a loss function, calculate the gradient of L, θ is the parameter of the target graph neural network model, G p is the augmented graph dataset, and c represents the class label.

[0028] Further, the graph encoder adopts a two-layer GCN network, which is used to obtain the embedding features of the graph, expressed as:

[0029]

[0030] Among them, A represents the adjacency matrix of the graph, X is the feature matrix of the graph, represents the normalized adjacency matrix, σ is the Relu activation function, W (0) and W (1) are the weight matrices of each layer in the two-layer GCN network respectively.

[0031] Further, step 3 includes:

[0032] 3.1) Take the original graph in the graph data subset and the enhanced graph derived from the original graph as a pair of positive sample pairs, and use the graph encoder to obtain the embedding features of the graphs in the graph data subset and the enhanced graph dataset. Denote the embedding feature of the i-th original graph in the graph data subset as z i and denote the embedding feature of the enhanced graph derived from the original graph as z' i ;

[0033] 3.2) Train the graph encoder; specifically:

[0034] Calculate the similarity of each positive sample pair:

[0035]

[0036] where the superscript T represents transpose, and ||.|| represents taking the modulus;

[0037] Calculate the cross-entropy loss:

[0038]

[0039]

[0040] where l i represents the loss value of the i-th pair of positive sample pairs, loss represents the total loss, and Γ represents the temperature parameter.

[0041] A backdoor attack defense system based on a motif-based graph network for implementing the above backdoor attack defense method.

[0042] A terminal includes a memory and a processor;

[0043] The memory is used to store a computer program;

[0044] The processor is used to implement the above backdoor attack defense method when executing the computer program.

[0045] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above backdoor attack defense method is implemented.

[0046] The beneficial effects of the present invention are mainly manifested in that, compared with existing types of backdoor attack defense methods, the present invention finds the most obvious motifs under each label but not obvious under other labels, uses these motifs as a feature of each label, and embeds these motifs into the graphs of some other labels to produce an enhanced graph dataset. Then, the enhanced graph and the original graph are used to form positive sample pairs to train the graph encoder, so that when performing the graph classification task, the motif has a high similarity with its corresponding label. When the trigger feature is similar to the motif feature existing in the graph, the present invention minimizes the influence of the motif feature on the task, reduces the influence of the trigger on the task, and thus defends against backdoor attacks.

[0047] This method can directly destroy the trigger structure inserted by the attacker in the graph, making it unable to achieve the expected effect, but without affecting normal samples, and the model can still exhibit the expected performance for input normal samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a schematic flowchart of a defense method against backdoor attacks for motif-based graph networks;

[0049] Figure 2 It is a schematic diagram for generating motif-based enhanced graph data. DETAILED DESCRIPTION OF THE INVENTION

[0050] The present invention will be further described below with reference to the accompanying drawings.

[0051] An embodiment of the present invention provides a defense method against backdoor attacks for graph neural networks. Please refer to Figure 1 , which includes the following steps:

[0052] S1. Obtain a target graph neural network model and a graph training set for training the target graph neural network model. Specifically:

[0053] S11. Denote the target graph neural network model as M oracle . In the present invention, the downstream task performed by this model is a graph classification task. M oracle is a graph classifier f: G → {0, 1,..., y i} that has been trained, where G is the corresponding input sample, and {0, 1,..., y i} is the predicted label of the corresponding classifier.

[0054] S12. Obtain the dataset Data oracle used for training the model M oracleIn this embodiment, the datasets used for training the model are the MUTAG dataset, the PROTEINS dataset, the NCL1 dataset, etc., and this data can be downloaded from the network. The above datasets are for graph classification tasks, and each dataset has several graphs G i and each graph has a corresponding label y i .

[0055] Graph data is composed of nodes and edges. Among them, graph data is represented by G, and the structural information of graph data is represented by the adjacency matrix A. If there is an edge between nodes i and j in the graph, then the value at the corresponding position e ij in its adjacency matrix is 1. If there is no edge between nodes i and j in the graph, then the value at the corresponding position e ij in its adjacency matrix is 0. Each node has a feature matrix X~U(0,1) from the same distribution.

[0056] For different datasets, their nodes and edges have their corresponding meanings. For example, in the MUTAG dataset, a graph represents a chemical molecule. Among them, the atoms in the molecule are all represented by nodes. If there is a chemical bond between two atoms, then there will be an edge between them, and each graph has its corresponding label. For example, the label of this data may be aromatic and heteroaromatic, and the label is represented by 0 and 1.

[0057] S2. Generate enhanced images, as Figure 2 shown, specifically as follows:

[0058] S21. Randomly select a certain proportion (for example, 10%, 15%, etc.) of the data from the training dataset Data oracle in step S12 to form a graph data subset Data defense consisting of N graphs;

[0059] S22. Calculate the motif distribution in the training dataset Data oracle in step S12 using the mfinder software, and obtain the motif distribution of each type of graph data.

[0060] S23. According to the motif distribution of each type of graph data obtained in step S22, select the most representative motif M in this type as the trigger motif for this type.

[0061] In this embodiment, the method for selecting the trigger motif is as follows:

[0062] S231. A motif is a unit composed of points and edges and is the basic element that makes up a graph. By determining the number of nodes and edges of the motif, various types of motifs can be obtained; in this embodiment, the number of nodes of the motif is set to 4, and the number of edges is 4 and 5.

[0063] S232. Calculate the distribution probability of each motif in each type of graph in the graph data subset. If the distribution probability of a certain motif in two or more types of graphs is higher than Q, then eliminate this motif; for example, Q is taken as 50%.

[0064] S233. For the remaining types of motifs, select the motif with the highest distribution probability from each type of graph, and determine whether the distribution probability of the selected motif in this type of graph is lower than q; for example, q is taken as 20%; if not, then use this motif as the trigger motif for this type of graph, otherwise, there is no trigger motif for this type of graph.

[0065] S24. From the graph data subset Data obtained in step S21 defense , generate enhanced graphs by embedding the trigger motifs of other types into each type of graph in the graph data subset with probability p, and obtain an enhanced graph dataset G composed of N enhanced graphs p .

[0066] S25. Use the enhanced graph dataset G obtained in step S24 p as the input of the target graph neural network model, and calculate the perturbation value ΔG of the enhanced graph. The formula is as follows

[0067]

[0068] where ΔG is the perturbation value of the enhanced graph, ε is a constant, sign(.) is a normalization function Calculate the gradient of L. L is the loss function, θ is the parameter of the target graph neural network model, G p is the enhanced graph dataset, and c represents the class label.

[0069] S26. Optimize the perturbation value of the enhanced graph, iteratively update the value of probability p in step S24 until the perturbation value is maximized, and use the finally obtained enhanced graph dataset G composed of N enhanced graphs p for subsequent calculations.

[0070] S3. Construct and optimize a graph encoder based on GCN.

[0071] S31. In this embodiment, a two-layer GCN network is used as the graph encoder. This structure can extract the node features and structural information in the graph and fuse them, and embed each node into a high-dimensional vector space. The specific operation method is as follows

[0072]

[0073] where A ∈ R n×n represents the adjacency matrix of the graph, X ∈ R n×M is the feature matrix of the graph, n represents the number of nodes in the graph, and M represents the number of features of the nodes; Denotes the normalized adjacency matrix, expressed as: I N is the identity matrix; is the degree value matrix of the nodes in the graph, which is a diagonal matrix, and its i-th diagonal element σ is the Relu activation function; W (0) ∈R M×H 、W (1) ∈R H×F are the weight matrices of each layer in the two-layer GNN network respectively, H represents the dimension of the hidden layer, Z ∈ R n×F is the hidden layer feature of n nodes output by the graph convolutional layer, and F represents the dimension of the output node embedding vector.

[0074] S32. Take the original graph in the graph data subset Data defense and the augmented graph from this original graph as a pair of positive sample pairs, and use the graph encoder to obtain the graph data subset Data defense and the embedding features of the graphs in the augmented graph dataset G p The embedding feature of the i-th original graph in the graph data subset is denoted as z i , and the embedding feature of the augmented graph from this original graph is denoted as z' i , i = 1, 2, …, N, a total of N pairs of positive sample pairs.

[0075] S33. Use cosine similarity to calculate the similarity between the embedding vectors of a pair of positive sample pairs, and the formula is as follows:

[0076]

[0077] where the superscript T is the transpose, and ||.|| represents taking the modulus;

[0078] Use the normalized temperature scale cross-entropy loss (NT-Xent) to calculate the cross-entropy loss:

[0079]

[0080]

[0081] where, l i represents the loss value of the i-th pair of positive sample pairs, loss represents the total loss, and Γ represents the temperature parameter.

[0082] S34. Optimize the parameters of the graph encoder GCN according to the loss function loss in S33. During training, adopt the training method of Mini - Batch Gradient Descent (MBGD). Each time, randomly select a batch of data from the training set for model training, which can not only avoid the training oscillation caused by Stochastic Gradient Descent (SGD), but also avoid the excessive consumption of resources by Batch Gradient Descent (BGD). In this embodiment, the batch size is selected as 128. The training objective is to adjust the structural parameters of the network through forward and backward propagation of gradients, and continuously reduce the value of the loss function of the model;

[0083] To avoid the interference of experimental contingency, this embodiment adopts ten - fold cross - validation, that is, divides the data set into 10 parts, selects 9 of them for training each time, and one part for testing. After training is completed, the network model for defending neural network backdoor attacks is built.

[0084] S4. Use of the defense model.

[0085] S41. Obtain the trained graph encoder GCN from step S34, and obtain the real graph data D in real - time real , first input the graph data D real into the graph encoder GCN to obtain its embedded features.

[0086] S42. Obtain the embedded features of the real graph data from step S41, and send them into the target graph neural network model M oracle for performing downstream tasks to obtain the corresponding task results.

[0087] The technical concept of the present invention is as follows: The triggering method of the backdoor attack is to use the sub - graph structure (motif) as a trigger, resulting in the neural network model with the trigger set to output incorrect results. Therefore, the present invention first searches for the motifs that the opponent may use as triggers, and maximizes the perturbation of the network by changing the links based on the motifs. Secondly, construct adversarial samples and optimize the parameters of the GCN - based graph encoder to make the features of positive samples as similar as possible. Finally, in the model testing stage, for the model input data, first pass it through the GCN graph encoder, and then input the output result of the graph encoder into the model to complete downstream tasks. When the trigger features are similar to the motif features existing in the graph, the present invention minimizes the influence of the motif features on the task as much as possible, so that the influence of the trigger on the task is reduced, thus achieving the defense against backdoor attacks.

[0088] In an embodiment of the present application, a terminal and a storage medium are provided.

[0089] A terminal, which includes a memory and a processor;

[0090] The memory is used to store a computer program;

[0091] The processor is used to implement the functions of the aforementioned backdoor attack defense method when executing the computer program.

[0092] It should be noted that the memory may include a Random Access Memory (RAM), or may also include a Non-Volatile Memory (NVM), such as at least one disk memory. The above-mentioned processor is the control center of the terminal, connecting various parts of the terminal through various interfaces and lines, and calling the data in the memory by executing the computer program in the memory to perform the functions of the terminal. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Of course, the terminal should also have the necessary components for program operation, such as a power supply, a communication bus, etc.

[0093] Exemplarily, the computer program can be divided into multiple modules, each of which is stored in the memory. Each separated module can complete a computer program instruction segment with a specific function, and this instruction segment is used to describe the execution process of the computer program. For example, the computer program can be divided into the following modules:

[0094] An initialization module, which is used to obtain a target graph neural network model and a graph training set for training the target graph neural network model;

[0095] A data augmentation module, which is used to randomly select a part of the graph data from the graph training set as a graph data subset; calculate the motif distribution in each class of graph data in the graph training set, select the trigger motif for each class of graph data, and embed the trigger motif into the graph data of other classes in the graph data subset to form an augmented graph data set;

[0096] A graph encoder training module, which is used to take the original graph in the graph data subset and the augmented graph from the original graph as a pair of positive sample pairs, and use the graph encoder to obtain the embedding features of all positive sample pairs, and train the graph encoder;

[0097] A defense module, which is used to obtain real graph data in real time, use the trained graph encoder to extract embedding features from the real-time graph data, and use the embedding features as the input of the target graph neural network model, and the output result of the target graph neural network model can effectively resist backdoor attacks.

[0098] The above modules can form a backdoor attack defense system for a motif-based graph network. For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiments described above are only illustrative, and the so-called data augmentation module may or may not be physically separated. In addition, each functional module in the present invention can be integrated in a processing unit, or each module can exist physically alone, or two or more modules can be integrated in one unit.

[0099] The programs in the above modules are all processed by the processor when executed.

[0100] In addition, when the logical instructions in the above-mentioned memory are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The memory, as a computer-readable storage medium, can be set to store software programs and computer-executable programs, such as the program instructions or modules corresponding to the system in the embodiments of the present disclosure. The processor executes functional applications and data processing by running the software programs, instructions or modules stored in the memory, that is, to implement the functions in the above embodiments. For example, various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks or optical discs that can store program codes can also be transient storage media. In addition, the specific processes of loading and executing multiple instructions in the above storage medium and the terminal by the processor have been described in detail above.

[0101] The content described in the embodiments of this specification is only an enumeration of the implementation forms of the inventive concept. The protection scope of the present invention should not be regarded as limited to the specific forms stated in the embodiments. The protection scope of the present invention also extends to equivalent technical means that those skilled in the art can think of according to the inventive concept of the present invention.

Claims

1. A backdoor attack defense method based on a motif-based graph network, characterized in that, It includes the following steps: Step 1: Obtain a target graph neural network model and a graph training set for training the target graph neural network model; the samples in the graph training set are chemical molecular structures, and each molecular structure corresponds to a class label; atoms in a molecule are represented by nodes, and if there is a chemical bond between two atoms, there is an edge between them, the structural information of the graph is represented by an adjacency matrix A, and the feature information is represented by a structural matrix X; Step 2: Randomly select a part of the graph data from the graph training set as a graph data subset; calculate the motif distribution in each class of graph data in the graph training set. A motif is a unit composed of nodes and edges and is the basic element that makes up a graph. By determining the number of nodes and edges of the motif, various types of motifs can be obtained; select the most representative motif in each class of graph data as the triggering motif for that class, and embed the triggering motif into the graph data of other classes in the graph data subset to form an enhanced graph data set; Step 3: Use the original graph in the graph data subset and the enhanced graph from the original graph as a pair of positive sample pairs. Use a graph encoder to obtain the embedding features of all positive sample pairs, use cosine similarity to calculate the similarity between the embedding features of a pair of positive sample pairs, use the normalized temperature-scaled cross-entropy loss to calculate the cross-entropy loss, and train the graph encoder according to the total loss of the positive sample pairs; The graph encoder adopts a two-layer GCN network and is used to obtain the embedding features of the graph, which is expressed as: Among them, A represents the adjacency matrix of the graph, and X is the structure matrix of the graph. represents the normalized adjacency matrix, σ is the Relu activation function, and W (0) , W (1) are the weight matrices of each layer in the double-layer GCN network respectively; Step 4: Real-time obtain real graph data, where the graph data is a chemical molecular structure. Use the trained graph encoder to extract the embedding features of the real-time graph data, use the embedding features as the input of the target graph neural network model, predict the label of the graph data, and the output result of the target graph neural network model can effectively resist backdoor attacks.

2. The motif-based graph network-based backdoor attack defense method according to claim 1, wherein, The said Step 2 includes: 2.1) Randomly select 10%-30% of the graph data from the graph training set to obtain a graph data subset composed of N graphs; 2.2) Calculate the motif distribution of each class of graph in the graph training set; 2.3) Take out the most representative motif in each class of graph in the graph training set as the triggering motif for that class; 2.4) For the graph data subset obtained in step 2.1), for each type of graph in the graph data subset, enhance the graph by embedding the trigger motifs of other classes with probability p to generate enhanced graphs, and obtain an enhanced graph dataset G consisting of N enhanced graphs. p ; 2.5) Take the enhanced graph dataset G p as the input of the target graph neural network model, and calculate the perturbation value of the enhanced graph; 2.6) Optimize the perturbation value of the enhanced graph, and iteratively update the value of probability p in Step 2.4) until the perturbation value is the largest.

3. The backdoor attack defense method based on the motif-based graph network according to claim 2, characterized in that, The method for selecting the triggering motif in Step 2.3) is: 2.3.1) Determine the number of nodes of the motif, and obtain various types of motifs according to the number of nodes of the motif; 2.3.2) Calculate the distribution probability of each motif in each class of graph in the graph training set. If there is a certain motif whose distribution probability in two or more classes of graphs is higher than Q, then eliminate this motif; 2.3.3) For the remaining types of motifs, respectively select the motif with the highest distribution probability from each class of graph, and judge whether the distribution probability of the selected motif in this class of graph is lower than q. If not, then use this motif as the triggering motif for this class of graph, otherwise, there is no triggering motif for this class of graph.

4. The backdoor attack defense method based on the motif-based graph network according to claim 2, wherein The calculation formula for the perturbation value of the enhanced graph is: where ΔG is the perturbation value of the enhanced graph, ε is a constant, sign(.) is a normalization function, and L is a loss function. Calculate the gradient of L, where θ is the parameter of the target graph neural network model, and G p is the enhanced graph dataset, and c represents the class label.

5. The motif-based graph network-based backdoor attack defense method according to claim 1, characterized in that The said Step 3 includes: 3.1) Use the original graph in the graph data subset and the augmented graph from the original graph as a pair of positive sample pairs. Use the graph encoder to obtain the embedding features of the graphs in the graph data subset and the augmented graph dataset. Denote the embedding feature of the $i$-th original graph in the graph data subset as $z$ i , and denote the embedding feature of the augmented graph from the original graph as $z$ i '; 3.2) Train the graph encoder; specifically: Calculate the similarity of each positive sample pair: where the superscript T is the transpose, and ||.|| represents taking the modulus; Calculate the cross-entropy loss: where l i represents the loss value of the i-th pair of positive samples, loss represents the total loss, and Γ represents the temperature parameter.

6. A backdoor attack defense system based on a motif-based graph network, characterized in that, For implementing the backdoor attack defense method described in claim 1; the backdoor attack defense system includes: An initialization module, which is used to obtain a target graph neural network model and a graph training set for training the target graph neural network model; the samples in the graph training set are chemical molecular structures, and each molecular structure corresponds to a class label; A data augmentation module, which is used to randomly select a part of the graph data from the graph training set as a graph data subset; calculate the motif distribution in each class of graph data in the graph training set, select the trigger motif for each class of graph data, and embed the trigger motif into the graph data of other classes in the graph data subset to form an augmented graph data set; A graph encoder training module, which is used to use the original graph in the graph data subset and the augmented graph from the original graph as a pair of positive sample pairs, obtain the embedding features of all positive sample pairs by using the graph encoder, and train the graph encoder; A defense module, which is used to obtain real graph data in real time, extract the embedding features of the real-time graph data by using the trained graph encoder, use the embedding features as the input of the target graph neural network model, and the output result of the target graph neural network model can effectively resist backdoor attacks.

7. A terminal, characterized in that, Including a memory and a processor; The memory is used to store a computer program; The processor is used to implement the backdoor attack defense method described in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the backdoor attack defense method described in any one of claims 1 to 5.

Images