Backdoor attack defense method and device for gradient-based link prediction

Abstract

The application discloses a backdoor attack defense method and device based on gradient link prediction, and the method comprises the following steps: acquiring original graph data set of a link prediction model; constructing a special subgraph; constructing an initial link prediction model and training the same; optimizing the special subgraph based on a gradient value to obtain an optimized defense training data set; training the link prediction model again by using the optimized defense training data set to obtain an optimized link prediction model; and completing backdoor attack defense by using the optimized link prediction model.

Description

Technical Field

[0001] The present invention relates to a backdoor attack defense method, and in particular to a backdoor attack defense method and device based on gradient link prediction. Background Art

[0002] Link prediction, an application of graph data mining, predicts unknown links based on the relationships between existing nodes and links and the characteristics of the nodes. It has been widely used in transaction networks and recommendation systems and has demonstrated its powerful performance. For example, e-commerce platforms such as Taobao and Amazon use existing user data and transaction records to train their recommendation systems to identify products that users may be interested in, thereby improving their purchasing experience.

[0003] While graph neural network link prediction brings convenience, it also presents numerous challenges. The security of graph neural network models is particularly crucial. Currently, the training of most graph neural network models relies heavily on the quality and quantity of the training dataset. Link prediction typically relies on clean training datasets with correct class labels to improve accuracy. However, most training datasets are collected through methods such as crawlers, making it difficult to prevent the presence of noise in the datasets, or even maliciously injected triggers that could lead to backdoor attacks. Backdoor attacks pose a serious threat to graph neural networks. Backdoor attacks occur during the training phase. Attackers train a model using training data with pre-set triggers. This allows the model to respond to inputs with embedded triggers in a highly predictable manner during the application phase, resulting in the model producing pre-set results while functioning normally with other normal inputs. Once a model is trained with triggers, it effectively creates a backdoor for attackers. Inputting data with embedded triggers during the model's deployment phase can lead to extremely serious consequences.

[0004] In the field of backdoor attacks on graph neural networks, several different attack methods have emerged in recent years. They all have good attack performance, but there are not many defense methods against backdoor attacks. This makes graph neural network models always at risk of backdoor attacks in the field of security, and the resulting serious consequences.

[0005] To this end, the present invention proposes a gradient-based link prediction backdoor attack defense method Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the present invention proposes a backdoor attack defense method based on gradient link prediction.

[0007] In order to solve the above technical problems, the technical solution of the present invention is:

[0008] A first aspect of an embodiment of the present invention provides a backdoor attack defense method for gradient-based link prediction, the method comprising the following steps:

[0009] S1. Obtain the original graph dataset of the link prediction model;

[0010] S2. Randomly hide links of a custom ratio from the original graph dataset obtained in step S1 to obtain a first training dataset; select links of a custom ratio from the first training dataset as target links; inject several nodes into the training dataset; the target links and several nodes form a special subgraph; and generate a second training dataset;

[0011] S3: Build a link prediction model based on GAE and train it using the first training data set to obtain a link prediction model M. link ;

[0012] S4. Input the second training data set into the link prediction model M link , we get the target link L i The prediction result is used to calculate the target link L through the cross entropy loss function. i The loss value between the predicted result and the original state is calculated, and then the gradient value of the relative loss value of the node features corresponding to the special subgraph constructed in step S2 and the injected nodes is calculated. According to the gradient value, the structure of the special subgraph and the node features corresponding to the injected nodes are optimized to obtain the optimized defense training dataset Data defense ;

[0013] S5, the defense training data set Data obtained in step S4 defense Input to the link prediction model M trained in step S3 link Optimize the training and get the optimized link prediction model M defense , using the optimized link prediction model M defense Complete the backdoor attack defense.

[0014] A second aspect of an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned gradient-based link prediction backdoor attack defense method.

[0015] A third aspect of an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned gradient-based link prediction backdoor attack defense method.

[0016] The beneficial effects of the present invention are: for most of the existing backdoor attack methods, a defense method for backdoor attacks is proposed. Virtual nodes are added near the two nodes of the target link to form a special subgraph, and the structural features and node features that have a great impact on the target link are obtained through the gradient. Then, the data set with this structure is used for model training, so that when predicting the link, this special structure has a high similarity with its corresponding target link state. This method can directly destroy the special subgraph structure (i.e., trigger structure) inserted in the graph data, causing it to fail to achieve the desired effect, but it does not affect normal samples. The link prediction model trained by the present invention can still show the expected performance for normal input samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Flowchart of the defense method for gradient-based link prediction backdoor attacks;

[0018] Figure 2 Schematic diagram for gradient-based adversarial example generation;

[0019] Figure 3 Schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0020] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0021] The technical concept of the present invention is: the triggering method of the backdoor attack is to use the subgraph structure as a trigger, which causes the target link with the trigger to be placed in the link prediction model to output an incorrect result. Therefore, the present invention proposes a gradient-based link prediction backdoor attack defense method. First, find the special subgraph structure that the opponent may use as a trigger, and minimize the loss function by changing the structure of the subgraph and the characteristics of the virtual node based on the gradient to obtain the adversarial sample. Secondly, the adversarial sample is passed through the GAE-based link prediction model, and the parameters of the encoder are optimized. Finally, the training of the GAE-based link prediction model is completed. In the model testing phase, for the model input data, regardless of whether there is a trigger in the model, the defense model can obtain the correct result. The main idea is that when the trigger features are similar to the special subgraph structure features and node features existing in the graph network, the impact of the trigger features on the task is minimized as much as possible, thereby playing a role in defending against backdoor attacks.

[0022] The embodiment of the present invention provides a defense method for link prediction backdoor attacks, please refer to Figure 1 and Figure 2 , the method comprises the following steps:

[0023] S1. Obtain the original graph dataset for the link prediction model.

[0024] The original graph dataset obtained by the present invention is selected from the Cora dataset, Citeseer dataset or PubMed dataset, etc., and the dataset can be downloaded from the Internet. The original graph dataset is for the link prediction task. Each dataset is a graph G. The graph data is composed of nodes and edges, where each node i has a corresponding class label. The structural information of the graph data is represented by the adjacency matrix A. ij Indicates that if there is an edge between nodes i and j, then the corresponding adjacency matrix position e ij The value is 1, and there is no edge e ij Its corresponding value is 0. Nodes and edges have distinct meanings for different datasets. For example, in the Cora dataset, a node represents a paper, and each paper cites or is cited by at least one other paper. These papers form a corpus. After processing the corpus, 1,433 unique words were obtained, representing the node features of the dataset. The node feature vector consists of 0s and 1s, with 0 indicating that the word does not exist in the paper and 1 indicating that the word exists in the paper.

[0025] S2. Randomly hide links of a custom proportion from the original graph dataset obtained in step S1 to obtain a first training dataset; select links of a custom proportion from the training dataset as target links; inject several nodes into the training dataset; the target links and several nodes constitute a special subgraph; and generate a second training dataset.

[0026] S21, from the original graph dataset Data in step S1 oracle Randomly hide a certain proportion (e.g., 10%, 15%, etc.) of links to form the first training data set Data train ,.

[0027] S22, from the training data set Data in step S21 train In the example, a certain proportion (e.g., 10%, 15%, etc.) of links are selected as target links L i .

[0028] S23, the training data set Data in step S21 train Inject several (for example, 2, 3, etc.) nodes n i .

[0029] S24, the target link L in step S22 i They respectively form a special subgraph G with several nodes in step S23 sub , forming a new second training data set Data deal .

[0030] The target link L in step S22 i Each of them forms a special subgraph G with several nodes in step S23 sub The process includes connecting several injected nodes and two nodes constituting the target link with each pair of nodes with a probability P (in this example, P is 0.5) to form a special subgraph G sub .

[0031] In the first training data set Data train The special subgraph G constructed in the sub , get the new second training data set Data deal .

[0032] S3: Build a link prediction model based on GAE and train it using the first training data set to obtain a link prediction model M. link ;

[0033] S31. The present invention requires a GAE-based link prediction model to perform graph encoding and decoding on graph data. The present invention uses a double-layer GCN structure as a graph encoder. This structure can extract and fuse node features and structural information in the graph, embedding each node into a high-dimensional vector space. The process can be expressed as:

[0034]

[0035] in, and I is the self-connection matrix of the graph, is the degree matrix, X is the node feature; W (0) is the weight matrix from the input layer to the hidden layer, W (1 ) is the weight matrix from the hidden layer to the output layer; σ1 and σ2 are activation functions, where σ1 uses the Softmax function and σ2 uses the ReLU function.

[0036] The decoder uses inner-product as the decoder to reconstruct the original graph. The process can be expressed as:

[0037]

[0038] in, is the activation function, here we use the sigmoid function; A′ is the reconstructed adjacency matrix; Z is the embedding vector.

[0039] S32, the first training data set Data in step S21 train Put it into the GAE-based link prediction model, according to the loss function loss train, the parameters of the link prediction model are optimized, and the calculation process is as follows:

[0040]

[0041] Among them, y and are the elements in the adjacency matrix before and after reconstruction, and N is the predicted number of edges.

[0042] The training goal is to adjust the structural parameters of the model by constructing the forward and backward propagation of the link prediction model based on GAE, continuously reduce the loss function value of the model until the loss function value converges, and obtain a link prediction model M with a certain link prediction ability. link .

[0043] S4 optimizes special subgraphs based on gradients.

[0044] S41, the second training data set Data obtained in step S24 deal Input the link prediction model M trained in step S32 link Get the target link L i The prediction results;

[0045] S42. Use the cross entropy loss function to calculate the target link L i The loss between the predicted result and the correct result grad , the calculation process is as follows:

[0046]

[0047] Among them L T is the target link, N is the number of target links, is the correct prediction result. The second training data set Data deal , f θ It is a pre-trained link prediction model.

[0048] S43, calculate the special subgraph G constructed in step S2 sub The gradient of the loss function for the node features corresponding to the structure and the injected nodes and The calculation process is as follows:

[0049]

[0050] Among them, A g is a special subgraph G sub The structure of X g is a special subgraph G sub The node features corresponding to the injected nodes, is a special subgraph Gsub The gradient matrix of the structure, is a special subgraph G sub The gradient matrix of the node features corresponding to the injected nodes. The positive or negative gradient value indicates whether the minimization loss function increases or decreases the value at the corresponding position in the gradient matrix.

[0051] S44, according to the structural gradient matrix To optimize the structure between special subgraphs, that is, if the special subgraph G sub If the gradient of the link between any two nodes is positive, the link between the two nodes is removed, otherwise the link between the two nodes is added. Optimize the features of the injected nodes. This process is similar to the special subgraph G. sub For structural optimization, if the feature is discrete, that is, the feature is composed of {0,1}, then the feature of the node is optimized according to the positive and negative gradient of the corresponding bit. If the gradient of the corresponding position is positive, the feature corresponding to the node is 0, otherwise it is 1. If the feature is continuous, that is, the range of the feature is [0,1], then the feature of the node is also optimized according to the positive and negative gradient of the corresponding bit. If the gradient of the corresponding position is positive, the feature corresponding to the node is subtracted from λ (0<λ<1), otherwise it is increased, while ensuring that the optimized node feature is still within the range of [0,1]. The process can be expressed as:

[0052]

[0053]

[0054] in, is the optimized special subgraph G sub structure, is the optimized special subgraph G sub The node features corresponding to the injected nodes are discrete, i.e., the features consist of {0, 1}, and λ is 1. The sign() function is used to determine the sign of the gradient. F(x) = ReLU(x) - ReLU(x-1) is used to prevent the final result from exceeding [0, 1].

[0055] S45, repeat steps S41 to S44, repeat several iterations until the loss loss in step S42 grad Tends to be stable and convergent, and obtains the optimal and Defense training dataset Data defense .

[0056] S5. Training and use of defense models

[0057] S51, the training data set Data in step S45defense Input to the GAE-based link prediction model M trained in step S3 link In the loss function, train , the parameters of the link prediction model are optimized. The training goal is to adjust the structural parameters of the model through the forward and backward propagation of the gradient, and continuously reduce the loss function value of the model until the loss function value converges, and obtain the link prediction model M with the ability to defend against backdoor attacks. defense ;

[0058] S52: Obtain the trained GAE-based link prediction model from step S51, and defense Data D for link prediction tasks real , D real Put it into the link prediction model to get the correct prediction result. At the same time, for the dataset D with backdoor backdoor ,The defense model can defend against backdoor attacks and still get the correct results.

[0059] Corresponding to the aforementioned embodiment of the backdoor attack defense method based on gradient link prediction, the present invention also provides an embodiment of the backdoor attack defense device based on gradient link prediction.

[0060] See also Figure 3 An embodiment of the present invention provides a backdoor attack defense device based on gradient link prediction, which includes one or more processors for implementing the backdoor attack defense method based on gradient link prediction in the above embodiment.

[0061] The embodiment of the backdoor attack defense device based on gradient link prediction of the present invention can be applied to any device with data processing capability, and the device with data processing capability can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capability in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From the hardware level, if Figure 3 As shown, it is a hardware structure diagram of any device with data processing capability where the backdoor attack defense device based on gradient link prediction of the present invention is located. Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0062] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0063] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present invention. A person of ordinary skill in the art can understand and implement the present invention without inventive work.

[0064] An embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the backdoor attack defense method for gradient-based link prediction in the above embodiment is implemented.

[0065] The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or memory. The computer-readable storage medium may also be any device with data processing capabilities, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and may also be used to temporarily store data that has been output or is to be output.

[0066] The contents described in the embodiments of this specification are merely an enumeration of the implementation forms of the inventive concept. The scope of protection of the present invention should not be regarded as limited to the specific forms described in the embodiments. The scope of protection of the present invention also extends to equivalent technical means that can be conceived by those skilled in the art based on the inventive concept.

Claims

1. A backdoor attack defense method based on gradient link prediction, characterized in that: The method comprises the following steps: S1. Obtain the original graph dataset for the link prediction model. The original graph dataset uses the Cora dataset, where each node represents a paper, and each paper cites or is cited by at least one other paper. All papers constitute a corpus. By processing the corpus, several unique words are obtained, namely the node features of the dataset. The node feature vector consists of 0 and 1, where 0 indicates that the individual word does not exist in the paper, and 1 indicates that the word exists in the paper. S2. Randomly hide links of a custom ratio from the original graph dataset obtained in step S1 to obtain a first training dataset; select links of a custom ratio from the first training dataset as target links; inject several nodes into the training dataset; the target links and several nodes form a special subgraph; and generate a second training dataset; S3: Build a link prediction model based on GAE and train it using the first training data set to obtain a link prediction model M. link ; S4. Input the second training data set into the link prediction model M link , we get the target link L i The prediction result is used to calculate the target link L through the cross entropy loss function. i The loss value between the predicted result and the original state is calculated, and then the gradient value of the relative loss value of the node features corresponding to the special subgraph constructed in step S2 and the injected nodes is calculated. According to the gradient value, the structure of the special subgraph and the node features corresponding to the injected nodes are optimized to obtain the optimized defense training dataset Data defense ; S5, the defense training data set Data obtained in step S4 defense Input to the link prediction model M trained in step S3 link Optimize the training and get the optimized link prediction model M defense , using the optimized link prediction model M defense Complete the backdoor attack defense.

2. The backdoor attack defense method based on gradient link prediction according to claim 1 is characterized in that: The original graph dataset is selected from the Cora dataset, Citeseer dataset or PubMed dataset.

3. The backdoor attack defense method based on gradient link prediction according to claim 1, characterized in that: The step S2 specifically includes the following steps: S21, the original image dataset Data obtained from step S1 oracle Randomly hide links of a custom ratio to form the first training data set Data train ; S22, the first training data set Data obtained from step S21 train Select a link with a custom ratio as the target link L i ; S23, the first training data set Data obtained in step S21 train Inject several nodes n i ; S24, the target link L obtained in step S22 i They respectively form a special subgraph G with several nodes in step S23 sub , forming the second training data set Data deal .

4. The backdoor attack defense method based on gradient link prediction according to claim 3 is characterized in that: The step S24 includes: for the injected nodes and the two nodes constituting the target link, each pair of nodes is connected with a probability P to form a special subgraph G sub .

5. The backdoor attack defense method based on gradient link prediction according to claim 1, characterized in that: The step S3 specifically includes the following steps: S31. Construct a GAE-based link prediction model to perform graph encoding and decoding on graph data; the GAE-based link prediction model includes a graph encoder and a decoder; wherein the graph encoder adopts a two-layer graph convolutional neural network, and the decoder adopts an inner-product decoder; S32: Use the first training data set to train, and adjust the structural parameters of the link prediction model until the loss function value converges to obtain the link prediction model M. link ; Among them, the calculation formula of the loss function value is as follows: Among them, y and are the elements in the adjacency matrix before and after graph reconstruction, and N is the predicted number of edges.

6. The backdoor attack defense method based on gradient link prediction according to claim 1, characterized in that: The step S4 specifically includes the following steps: S41, the second training data set Data obtained in step S24 deal Input the link prediction model M trained in step S32 link Get the target link L i The prediction results; S42. Use the cross entropy loss function to calculate the target link L i The loss between the predicted result and the original state grad , the calculation process is as follows: Among them L T is the target link, N is the number of target links, It is the original state, The second training data set Data deal , f θ It is a pre-trained link prediction model; S43, calculate the special subgraph G constructed in step S2 sub The gradient of the loss function for the node features corresponding to the structure and the injected nodes and The calculation process is as follows: Among them, A g is a special subgraph G sub The structure of X g is a special subgraph G sub The node features corresponding to the injected nodes, is a special subgraph G sub The gradient matrix of the structure, is a special subgraph G sub The gradient matrix of the node features corresponding to the injected nodes; S44, according to the gradient matrix To optimize the structure of the special subgraph, according to the gradient matrix Optimize the characteristics of injection nodes; S45, repeat steps S41 to S44 several times until the loss loss in step S42 is grad Converge and get the final defense training dataset Data defense .

7. The backdoor attack defense method based on gradient link prediction according to claim 6, characterized in that: The step S44 is specifically as follows: According to the gradient matrix The process of optimizing the structure of a special subgraph includes: if the special subgraph G sub If the gradient of the link between any two nodes is positive, the link between the two nodes is removed; otherwise, the link between the two nodes is added. According to the gradient matrix The process of optimizing the features of the injected node includes: if the features of the node are discrete, that is, the features of the node are composed of {0, 1}, then the features of the injected node are optimized according to the positive and negative of the corresponding position gradient. If the corresponding position gradient is positive, the feature corresponding to the node is 0, otherwise it is 1; If the feature of the node is continuous, that is, the range of the node feature is [0,1], the feature of the node is injected according to the positive and negative optimization of the corresponding bit gradient. If the gradient of the corresponding position is positive, the feature corresponding to the node is subtracted from λ, otherwise it is increased.

8. An electronic device comprising a memory and a processor, characterized in that: The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the gradient-based link prediction backdoor attack defense method described in any one of claims 1-7 above.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the backdoor attack defense method for gradient-based link prediction according to any one of claims 1 to 7 is implemented.

Images