Backdoor real-time monitoring method based on time sequence diagram convolution network, electronic device and medium

Abstract

This invention discloses a real-time backdoor monitoring method, electronic device, and medium based on a temporal graph convolutional network. The method involves selecting a normal dataset and generating a backdoor dataset by specifying the positions of triggers on the normal dataset using a mask matrix. A neural network model is trained on both the normal and backdoor datasets to obtain normal models and their corresponding backdoor models at different time points. A model graph is constructed based on neuron thresholds. The graph signature vector corresponding to the model graph is calculated and concatenated to obtain a sequence graph signature matrix. The temporal graph convolutional network is trained using the sequence graph signature matrix as a backdoor monitor. For any model to be detected composed of a deep neural network, the sequence graph signature matrix corresponding to the model is calculated and input into the backdoor monitor, thereby enabling backtracking and monitoring of the state of the model at different training time points.

Description

Technical Field

[0001] This invention belongs to the field of backdoor attack defense and detection, specifically involving a backdoor real-time monitoring method, electronic device, and medium based on temporal graph convolutional networks. Background Technology

[0002] In recent years, deep neural networks (DNNs) have been successfully applied to many critical tasks, such as facial recognition, autonomous driving, smart healthcare, and drone navigation, attracting widespread attention due to their significant security implications. Existing security research on DNNs largely focuses on adversarial attacks, exploring vulnerabilities in the inference phase. Beyond the inference phase, DNN training involves numerous steps, including data collection, data preprocessing, model selection and construction, training, model storage, and model deployment. All of these steps are susceptible to malicious attacks. Furthermore, because the powerful capabilities of DNNs largely depend on large amounts of training data and computational resources, many individual users and small businesses choose to use free third-party datasets instead of collecting their own training data to reduce training costs; they can also train DNNs on third-party platforms (such as cloud computing platforms) instead of local training; users can even directly use pre-trained models provided by third parties to perform local tasks. The price of this convenience is the loss of control over the training phase, which may further amplify the security risks inherent in DNN training. A typical threat during the training phase is backdoor attacks.

[0003] Backdoor attacks aim to embed hidden backdoors into deep neural networks (DNNs), making the attacked model perform well on benign samples. However, if the hidden backdoor is activated by a trigger specified by the attacker, its predictions will be maliciously altered. This threat can occur when the training process is not fully controlled. Although backdoor learning is an emerging and rapidly developing research field, its detection and discovery remain challenging.

[0004] On the other hand, due to their ability to learn complex relationships or interaction systems, Graph Neural Networks (GNNs) have been frequently used in recent years to analyze and solve various classification and prediction tasks related to graph data. Graphs are widely used as models of relationship and interaction systems in many fields, particularly social sciences and biology. GNNs can be used to learn from such data; they typically aggregate information from the vicinity of nodes through message passing mechanisms and create node embeddings, which are then used for node classification, graph classification, or edge prediction tasks. These tasks cover a wide range of problems, including biology, particle physics, social networks, and recommender systems. Among these, graph structures whose features or connectivity evolve over time are called dynamic graphs. Analysis of dynamic graphs can enable functions such as prediction and monitoring.

[0005] Backdoor attackers protect and exploit different types of backdoor triggers. Backdoor attacks are often covert and difficult to detect, making real-time monitoring of potential backdoor attacks during model training a challenge, especially detecting backdoor inputs during training. Traditional backdoor detectors typically only detect the probability of a backdoor vulnerability in the target model using a large number of test samples before deployment, failing to detect potential backdoor injections during training. This invention considers modeling a DNN model using a graph structure, using the dynamic changes of the graph structure to reflect various normal and abnormal changes during model training (training fit, injection of backdoor triggers), and using a temporal graph convolutional network to capture the network's dynamic characteristics, thereby discovering potential backdoor operations during training. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention proposes a real-time backdoor monitoring method, electronic device, and medium based on temporal graph convolutional networks.

[0007] The technical solution of the present invention is as follows: a real-time backdoor monitoring method based on temporal graph convolutional networks, the method specifically includes the following steps:

[0008] (1) Select a normal dataset, specify the position of the trigger on the normal dataset by the mask matrix to generate a backdoor dataset, train the neural network model based on the normal dataset and the backdoor dataset respectively, and obtain the normal model and its corresponding backdoor model at different times.

[0009] (2) Constructing the model graph: Define neurons whose output values ​​are greater than or equal to the threshold as active neurons and neurons whose output values ​​are less than the threshold as inactive neurons; retain the active neurons and their connected weights to construct the topology of the model graph; use the pathways between active neurons as activation pathways, and add activation pathways to the topology of the model graph to obtain the constructed model graph.

[0010] (3) Calculate the graph indicators, including graph clustering coefficient, global average degree, average path length, and modularity index, of the model graph constructed in step (2) as a graph signature vector; and concatenate the calculated graph signature vectors in time sequence to obtain a sequence graph signature matrix.

[0011] (4) Use the sequence graph signature matrix obtained in step (3) to train a temporal graph convolutional network as a backdoor monitor;

[0012] (5) For any model to be detected composed of a deep neural network, repeat steps (2) and (3) to obtain the sequence graph signature matrix corresponding to the model to be detected. Input the sequence graph signature matrix into the backdoor monitor trained in step (4). The backdoor monitor calculates the probability that the model to be detected may introduce a backdoor during the current training time period, thereby realizing the backtracking and monitoring of the state of the model to be detected at different training times.

[0013] The beneficial effects of this invention are as follows: This invention proposes a real-time backdoor detection method based on temporal graph convolutional networks, which can construct temporal data using model information at training time, improve graph signature features, and enhance the accuracy of backdoor detection; the method of this invention uses only a small amount of backdoor data to activate and obtain the sequence graph signature feature matrix, reducing dependence on privacy data and ensuring the security of outsourced training user data; in practical use, this invention only needs to save graph signature logs, occupying a small space capacity, and the backdoor detector built based on temporal graph convolutional networks can achieve real-time performance and traceability. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a schematic diagram of the overall process of the method of the present invention.

[0016] Figure 2 This is a schematic diagram of a backdoor sample with triggers generated in the method of the present invention.

[0017] Figure 3 This is a schematic diagram illustrating the construction process of the model diagram in the method of the present invention.

[0018] Figure 4 This is a schematic diagram of the backdoor monitor used in the method of the present invention.

[0019] Figure 5 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings. Unless otherwise specified, the features of the following embodiments and implementations can be combined with each other.

[0021] Backdoor attacks targeting DNNs pose a potential security threat to deep learning systems. While deep learning systems achieve state-of-the-art performance on clean datasets, they exhibit anomalies when subjected to inputs with pre-defined triggers set by attackers. However, existing backdoor triggers are diverse, and the backdoor features implanted by different triggers during backdoor training are inconsistent. Deep learning training processes based on cloud-outsourced training or third-party pre-trained models are vulnerable to various types of backdoor attacks. Existing backdoor attack detection techniques typically require prior knowledge of the trigger types and a sufficiently large dataset with category annotations, which is difficult to achieve in real-world scenarios. To address this, this invention proposes a real-time backdoor monitoring method based on temporal graph convolutional networks (TMBs) to achieve real-time monitoring of potential backdoor attacks during the training process.

[0022] The technical concept of this invention is as follows: In complex deep learning model training scenarios, model users often need to rely on multiple third-party computing resources to assist in training the target model due to a lack of data or computing resources. To ensure the safe and standardized training of the model, it is necessary to have a monitor conduct corresponding security tests on the training process or the aggregated model. Based on this safe and reliable scenario, where the monitoring party can only obtain partial data and training logs, an effective method is needed to monitor potential backdoor scenarios introduced during training in real time to prevent malicious third-party trainers from inserting malicious backdoors into the model. This invention constructs the neural network model parameters into a corresponding graph structure and uses a temporal graph convolutional network to capture the temporal changes in model graph metrics during the training process. By tracing the mutation moments of graph signature features in the temporal process, it monitors the behavior of malicious backdoor insertion in real time, thereby achieving the monitoring of potential backdoor behaviors in the third-party training process. First, different types of backdoor models are constructed using various backdoor training methods. Then, the concept of neural pathways is used to set thresholds and divide activated neurons, and the topological structure of activated neurons from backdoor samples guides the construction of the model graph. Graph signatures are constructed using global graph metrics, and a sequence graph signature feature matrix is ​​formed by combining graph signatures from different time points. Graph convolutional networks are trained with graph signatures of different time lengths to capture the sequence features of the training process. Finally, the graph signature log information saved at each training time point is input into the graph convolutional network, which can monitor in real time whether a backdoor is inserted during the training process, thus ensuring the safe conduct of third-party training.

[0023] Reference Figures 1-3 This invention proposes a real-time backdoor monitoring method based on temporal graph convolutional networks, the steps of which are as follows:

[0024] (1) Generate a backdoor dataset by specifying the positions where triggers are added to the normal dataset using a mask matrix. Train the neural network model based on both the normal dataset and the backdoor dataset to obtain the normal model and its corresponding backdoor model at different time points. Specifically, this includes the following sub-steps:

[0025] (1.1) Select a normal dataset, and then use a mask matrix to specify the position where the triggers are added on the normal dataset to generate a backdoor dataset.

[0026] Generating the graph model requires training the normal model and the corresponding backdoor model at different time points. First, a backdoor dataset containing triggers is generated for backdoor training. This requires adding trigger patterns for specific backdoor attacks to the normal dataset (i.e., the original clean data).

[0027] like Figure 2 As shown, this embodiment of the invention provides a method for generating backdoor samples. Specifically, this scheme adds a 9-pixel block to the CIFAR-10 dataset. The location of the trigger is specified by a mask matrix. The original sample x has a size of 32*32 pixels, and the mask matrix is ​​set to E. M The trigger matrix is ​​E T Then the backdoor sample x' = x*(1-E) M )+E T For each of the 10 categories of CIFAR-10 images, 50% of the samples were extracted as backdoor samples and inserted into the original random 50% clean samples to form a mixed dataset for training the backdoor model. The other part of the complete clean CIFAR-10 dataset was used to train the clean model.

[0028] (1.2) The neural network model is trained based on the normal dataset and the backdoor dataset respectively to obtain the normal model and its corresponding backdoor model at different times.

[0029] A normal dataset is input into the neural network for training to obtain a normal model.

[0030] The backdoor dataset with the added trigger in step (1.1) is mixed with the normal dataset and then input into the neural network for training to obtain the corresponding backdoor model.

[0031] For example, the backdoor dataset and normal dataset obtained in step (1.1) are mixed and input into the neural network for training. The goal of the backdoor samples in the backdoor dataset is to classify the original class into the target class. In each backdoor training, only one combination of the original class and the target class is selected. The combination of normal samples (such as dog pictures) and correct class labels (dog class labels) as well as the corresponding backdoor samples with added triggers (such as dog pictures with inserted pixel blocks) and incorrect class labels (such as cat class labels) are input into the model to train the backdoor model.

[0032] In this example, we use the AlexNet model and the CIFAR-10 dataset to train a backdoor and perform subsequent backdoor vulnerability testing. The CIFAR-10 dataset contains 10 classes: airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and truck. The hyperparameter settings for one set of backdoor training parameters are as follows: 50 training epochs, 256 batch sizes, using the Adadelta optimizer, and the cross-entropy loss function. The training process is expressed by the following formula:

[0033]

[0034] Where p() represents the probability of the training class label appearing in the training sample, the training class label of the normal sample is itself (dog image corresponds to the dog class label), and the training class label of the backdoor sample is the attack target class (dog image corresponds to the cat class label); q() represents the predicted probability of the model, x i This represents the input sample. The only difference between backdoor training and normal model training is that the dataset used for backdoor training is a mixture of the normal dataset and the backdoor dataset with added triggers.

[0035] In this example, clean training is first performed 0, 5, 10, 15, and 20 times, and the model parameters for each training iteration are saved. Then, backdoor training continues starting from the models from clean training iterations 0, 5, 10, and 15, until a total of 20 training iterations are completed. This results in five model combinations: (0 / 20), (5 / 15), (10 / 10), (15 / 5), and (20 / 0), along with all intermediate weight parameters from each training iteration, which are used to train the temporal convolutional network.

[0036] (2) Constructing the model graph: Define neurons whose output values ​​are greater than or equal to the threshold as active neurons and neurons whose output values ​​are less than the threshold as inactive neurons; retain active neurons and their connected weights to construct the topology of the model graph; use the pathways between active neurons as activation pathways, and add activation pathways to the topology of the model graph to obtain the constructed model graph.

[0037] Step (2) specifically includes:

[0038] Based on the clean model and backdoor model trained in (1), for the fully connected layer structure, only the key output weights of the activated neurons are extracted. The samples are input into each model sequentially, and the output of each layer is recorded as follows:

[0039] Output l =Layerl (Output l-1 )

[0040] Among them, Layer l Represents the layer function of the l-th layer, Output l It is the output matrix returned by the layer function of the l-th layer, which is the input parameter of the previous layer. Here, let the output of the sample in the l-th layer of the backdoor model be denoted as . The output of the sample in the l-th layer of the clean model is Activated and inactive neurons are distinguished by the activation threshold of each layer; specifically, the maximum value w of the neuron weight in each layer is obtained. max , with 0.5w max A threshold is set; neurons with weights below this threshold are considered inactive. For example... Figure 3 As shown in (b), the pathways between activated neurons are considered as activated pathways, and all weights and connections of the activated pathways are preserved. Inactive neurons, i.e., inhibitory neurons, have pathways between them considered as inhibitory pathways, and all weights and connections related to inhibitory pathways are deleted. Pathways between activated and inhibitory neurons are considered as semi-activated pathways. All semi-activated pathways connected to a specific inhibitory neuron in the output layer are calculated, and only the pathway with the largest weight norm is retained as the effective activated pathway. Through these operations, the sparsity of the fully connected layers of the model is ultimately achieved. Finally, the propagation relationships between neurons and their output weights in the fully connected layers of the model are mapped one-to-one to the nodes and edges of the graph structure, thus constructing the sparsified model graph.

[0041] For the structure of convolutional layers, first unfold the convolutional layer, then simplify the convolutional structure to the case of a fully connected layer, such as... Figure 3 As shown in (a), the nodes and edges of the model graph are defined, and the convolution operation is represented as matrix multiplication. Specifically, for the input image X and the convolution kernel... The model graph nodes of the l-th layer are defined as each filter f i The output is a mapping of the input features. Each of these nodes is connected to the node corresponding to the output neuron in the next layer. These connection values ​​are obtained by weighting the activation value of the neuron (i.e., multiplying the input image of a specific stride by the filter value at that location in the image).

[0042] The above two processes construct complete model graphs for fully connected layers and convolutional layers respectively. The edge sizes of the graphs correspond to the norm values ​​of the model weights. Graph nodes in fully connected layers correspond one-to-one with neurons in the model, and graph nodes in convolutional layers correspond to convolutional kernels. Specifically, in this example, a CIFAR-10 backdoor sample is used. After inputting a dog sample containing triggers into the AlexNet model, the pixel matrix of the sample is multiplied by the weights of each neuron in the layer to obtain the sample activation weights. For the fully connected layer structure, each activated neuron in the model is mapped to a node in the graph structure, and the norm of the model sample activation weights in each layer is used as the edge weights of the graph structure. The graph weight matrix W... G =||W model ||.

[0043] (3) Calculate the temporal graph signature attribute of the model graph for training the temporal graph convolutional network:

[0044] (3.1) This invention uses four basic graph metrics—graph clustering coefficient, average node degree, average path length, and modularity—to jointly form the graph signature. The graph clustering coefficient C measures the degree of clustering of nodes in the graph. For a node i in the graph, e... i k represents the number of edges between the neighbors of node i. i Let represent the number of neighboring nodes of node i. The calculation method for graph clustering is as follows:

[0045]

[0046] Node degree refers to the number of connections a given node in a graph has to all other nodes. This method constructs a directed graph by calculating both the in-degree and out-degree of each node. The average degree of a graph is the average degree of all nodes in the graph. For a graph with n nodes, the degree of each node is d. k The formula for calculating the average degree is as follows:

[0047]

[0048] The average path length of a graph refers to the average distance of the edges connecting any two nodes. For a weighted directed graph, the average path length is the weighted average of the directed distances between any two nodes. The average path length is also called the characteristic path length or average distance of the graph.

[0049]

[0050] Where N is the number of nodes in the graph.

[0051] The modularization of the graph grouped nodes with the same characteristics together to form clusters. The nodes in the graph were divided into accumulations in an unsupervised manner, and the clustering characteristics of the nodes were strongly correlated with the classification effect of the corresponding categories.

[0052] (3.2) Calculate the relevant metrics of the model graph using the method in step (3.1), and combine the 5 1*4 graph signature vectors of each time series into a 5*4 graph signature matrix. For example, graph signatures for 16 time slices in rounds 1-5, 2-6, 3-7…16-20 (the graph signature for each time segment comes from the model after activation by different backdoor samples). Randomly select 50 backdoor samples to construct a total of 5000 sequence graph signatures for training the temporal graph convolutional network.

[0053] (4) Use the sequence graph signature S={G(t1),G(t2),…G(t5)} calculated in step (3) to train a temporal graph convolutional network as a backdoor monitor F.

[0054] Specifically, the structural block diagram of the backdoor detector F is as follows: Figure 4 As shown, firstly, the graph signature matrix, concatenated from multiple time steps, serves as the input to the detector, passing through its encoding layer. The encoding layer consists of a temporal graph feature network, which further refines the features of the graph signature matrix and inputs the features from each time step into a temporal LSTM structure to extract temporal information during training. The hidden features output by the LSTM are then back-decoded in the decoding layer, ultimately yielding a binary classification vector of the model graph. This binary vector can be divided using a simple MLP or SVM structure to determine whether the model graph is a backdoor model graph.

[0055] Specifically, the graph signature vector G(t) at each time step includes a transformation in two dimensions: ① node-level v i (t), where i represents the node index and v represents the node feature. If the node exists, the corresponding node feature is updated; otherwise, the node and its feature are added. ② Edge-level e ij (t) indicates the presence of a time-related edge. All edges in this method are undirected.

[0056] The task of a temporal graph convolutional network is to calculate the scale of change of the sequential graph signature features at each time step t, D = |G(t), based on the continuous graph signature features that change over time. i )-G(t j )| distanceA Long Short-Term Memory (LSTM) module is used to preserve the long-term features of nodes. When a new graph signature is input into the network, the scale of change at the current time step is recalculated. The class information of the graph signature sequence containing the backdoor, and all subsequent graph signature sequences, is set to "contains backdoor," while the class information of all time steps before the backdoor training time step is set to "does not contain backdoor." The temporal graph convolutional network is then retrained. The trained evaluator can then be used to assess the model's vulnerability. After the model is transformed into a graph structure through sample activation, the graph indicator feature vector can be quickly calculated to complete the evaluation.

[0057] (5) The backdoor monitor F obtained in step (4) is used to detect backdoors in real time during the model training process. During the model training process, after each round of training, a portion of training samples are input to activate the corresponding model graph, and the calculated graph index vector is saved as a training log. The monitor only needs to use the graph index information saved in the training log corresponding to the suspicious training stage to calculate the probability that a backdoor may be introduced during the current training period. This enables the backtracking and monitoring of the state at different training moments.

[0058] Experimental results on backdoor detection using an AlexNet model trained on the CIFAR-10 dataset demonstrate that our method can discover backdoor vulnerabilities within a maximum of two training epochs, achieving a global detection accuracy of 91%. Furthermore, on a VGG16 model trained on large image datasets like CIFAR-100, we can also discover backdoor vulnerabilities within a maximum of two training epochs, with a global detection accuracy exceeding 85%.

[0059] Accordingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the real-time backdoor detection method based on a temporal graph convolutional network as described above. Figure 5 The diagram shown illustrates a hardware structure of any device with data processing capabilities for implementing a backdoor real-time monitoring method based on a temporal graph convolutional network, as provided in an embodiment of the present invention. (Except for...) Figure 5 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0060] Accordingly, this application also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement a differential privacy and noise reduction data protection method under a vertical federation framework as described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of a wind turbine, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0061] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only.

[0062] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A backdoor real-time monitoring method based on a time series graph convolution network, characterized in that, The method specifically includes the following steps: (1) Select a normal dataset, specify the position of the trigger on the normal dataset by the mask matrix to generate a backdoor dataset, train the neural network model based on the normal dataset and the backdoor dataset respectively, and obtain the normal model and its corresponding backdoor model at different times; (2) Constructing the model graph: Define neurons whose output values ​​are greater than or equal to the threshold as active neurons and neurons whose output values ​​are less than the threshold as inactive neurons; retain active neurons and their connected weights to construct the topology of the model graph; use the pathways between active neurons as activation pathways, and add activation pathways to the topology of the model graph to obtain the constructed model graph. (3) Calculate the graph indicators, including graph clustering coefficient, global average degree, average path length, and modularity index, of the model graph constructed in step (2) as a graph signature vector; and concatenate the calculated graph signature vectors in chronological order to obtain a sequence graph signature matrix. (4) Using the sequence graph signature matrix obtained in step (3), train a temporal graph convolutional network as a backdoor detector; including: The temporal graph convolutional network includes an encoder, a decoder, and a binary classifier. The sequence graph signature matrix is ​​input to the encoder to extract temporal information. The temporal information is input to the encoder for reverse decoding to obtain the binary classification vector of the model graph. The binary classifier divides the binary classification vector to determine whether the model graph is a backdoor model graph, and trains a backdoor detector. The temporal graph convolutional network is used to calculate the change scale of the sequential graph signature features at each time step in real time as the continuous graph signature features change with time; the graph signature vector includes: node features and time-related edges, and the edges are undirected edges; (5) For any model to be detected composed of a deep neural network, repeat steps (2) and (3) to obtain the sequence graph signature matrix corresponding to the model to be detected. Input the sequence graph signature matrix into the backdoor monitor trained in step (4). The backdoor monitor calculates the probability that the model to be detected may introduce a backdoor during the current training time period, thereby realizing the backtracking and monitoring of the state of the model to be detected at different training times. 2.The backdoor real-time monitoring method based on the time series graph convolution network according to claim 1, wherein, The step (2) obtains the maximum value of each neuron weight in the neural network model , and sets the threshold value. 3.The time series graph convolutional network based backdoor real-time monitoring method according to claim 1 or 2, characterized in that, Step (2) specifically includes: Based on the clean model and backdoor model trained in (1), when the clean model and backdoor model are fully connected layer structures, extract the key output weights of the activated neurons; input the samples into each model in sequence, and record the output of each layer as follows: ； in, Indicates the first Layer functions, It is the parameter input of the previous layer. The output matrix returned by the layer function of the layer; let the sample be the layer of the backdoor model. The output of the layer is The sample in the clean model The output of the layer is Activated and inactive neurons are distinguished by activation thresholds at each layer. Neurons whose output values ​​are greater than or equal to the threshold are defined as activated neurons, and those whose output values ​​are less than the threshold are defined as inactive neurons. Pathways between activated neurons are considered as activation pathways, and all weights and connections of the activation pathways are preserved. Inactive neurons are also known as inhibitory neurons, and pathways between inhibitory neurons are considered as inhibitory pathways. All weights and connections related to inhibitory pathways are deleted. Pathways between activated and inhibitory neurons are considered as semi-activated pathways. All semi-activated pathways connected to an inhibitory neuron in the output layer are calculated, and only the pathway with the largest weight norm is retained as a valid activation pathway. Sparsity is achieved for the fully connected layers of the model. The propagation relationships between neurons and their output weights in the fully connected layers of the model are mapped one-to-one to the nodes and edges of the graph structure, resulting in the constructed model graph. 4.The backdoor real-time monitoring method based on the time series graph convolution network according to claim 1, wherein, The formula for calculating the clustering coefficient in step (3) is as follows: ； where the graph clustering coefficient for measuring the clustering degree of nodes in a graph, i is a node on the graph, denotes the number of edges between the neighbors of node i, denotes the number of neighbor nodes of node i; The formula for calculating the global average degree is as follows: ； where n is the number of nodes, is the degree of each node; The formula for calculating the average path length is as follows: ； In the formulae, is the number of nodes in the graph. 5.The backdoor real-time monitoring method based on the time series graph convolution network according to claim 1, wherein, The binary classifier is selected from MLP or SVM binary classifiers. 6.An electronic device comprising a memory and a processor, the electronic device characterized by, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the backdoor real-time monitoring method based on temporal graph convolutional networks as described in any one of claims 1-5.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that When the program is executed by the processor, it implements the backdoor real-time monitoring method based on temporal graph convolutional networks as described in any one of claims 1-5.

Images